This Metasploit module can create, read, update, and delete AD CS certificate templates from a Active Directory Domain Controller. The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be restored using the CREATE or UPDATE actions. The CREATE and UPDATE actions require a certificate template data file to be specified to define the attributes. Template data files are provided to create a template that is vulnerable to ESC1, ESC2, and ESC3. This Metasploit module is capable of exploiting ESC4.
39e78029adb8e2f049f0341e4f83ee9ba74d76ede012c61713ede2f024542edd