Active Directory Certificate Services is a critical component of Ac Active Directory. In 2021 researchers from SpecterOps discovered several novel privilege escalation in Active Directory. During a recent engagement, @Bandrel discovered how an attacker can change the purpose of a certificate by crafting a special certificate request. An attacker can craft a CSR to include application policies that are preferred over the configured Extended Key Usage attributes specified in the template. The only requirement is enrollment rights, and it can be used to generate client authentication, certificate request agent, and codesigning certificates using the WebServer template. This talk walks through the discovery process and the experience with MSRC reporting the issue. CVE-2024-49019