Locksmith 2

An AD CS toolkit for Active Directory Admins, Defensive Security Professionals, and Filthy Red Teamers

Overview

Locksmith 2 is a comprehensive PowerShell module for auditing Active Directory Certificate Services (AD CS) infrastructure. It identifies security misconfigurations across certificate templates, certification authorities, and PKI infrastructure objects based on established ESC (Escalation) techniques.

Built for AD administrators, security professionals, and penetration testers, Locksmith 2 provides:

• Automated vulnerability scanning for ESC1-ESC16 techniques
• Detailed remediation scripts for each discovered issue
• Granular cmdlets for targeted security assessments
• Comprehensive reporting with human-readable output
• Educational resources explaining each vulnerability

Locksmith 2 represents the next generation in the Locksmith line of open-source AD CS security tooling, improving upon the original with better code organization, enhanced reporting, and deeper risk analysis.

Features

• Scan certificate templates for ESC vulnerabilities
• Audit certification authorities for ESC vulnerabilities
• Check PKI infrastructure objects for ESC vulnerabilities
• Generate PowerShell remediation scripts
• Generate PowerShell scripts to revert remediations (partial)
• Support for non-domain-joined systems
• Object output
• HTML dashboard output
• In-dashboard export to CSV, Excel, PDF
• Interactive TUI for guided remediation

Installation

From PowerShell Gallery

Install-Module -Name Locksmith2 -Scope CurrentUser -Force

From Source

git clone https://github.com/jakehildreth/Locksmith2.git
cd Locksmith2
Import-Module .\Locksmith2.psd1

Quick Start

Start in Interactive mode

Invoke-Locksmith2

Generate HTML Dashboard

New-LS2Dashboard

Supported ESC Techniques

Technique	Description	Target Objects	Sub-techniques
ESC1	Misconfigured Certificate Templates	Templates	—
ESC2	Certificate SubCA Abuse	Templates	—
ESC3	Enrollment Agent Restrictions	Templates	ESC3c1, ESC3c2
ESC4	Vulnerable Access Control	Templates	ESC4a (ACL), ESC4o (owner)
ESC5	Vulnerable PKI Object Access Control	Infrastructure Objects	ESC5a (ACL), ESC5o (owner)
ESC6	EDITF_ATTRIBUTESUBJECTALTNAME2 Enabled	CAs	—
ESC7	Vulnerable CA Administrator/Manager Roles	CAs	ESC7a (admin), ESC7m (manager)
ESC8	Vulnerable Web Enrollment Endpoints	CAs	—
ESC9	Weak Certificate Mappings	Templates	—
ESC11	Missing RPC Encryption	CAs	—
ESC13	Group-Linked OID Application Policy	Templates	—
ESC16	Disabled CRL/AIA Security Extensions	CAs	—

For detailed information on ESC techniques, see Certified Pre-Owned by SpecterOps.

cmdlet Reference

Primary Functions

Invoke-Locksmith2

Performs comprehensive AD CS security audit scanning for all known ESC vulnerabilities.

Invoke-Locksmith2 [-Forest <String>] [-Credential <PSCredential>] [-Mode <Int>]
                  [-SkipVersionCheck] [-SkipPowerShellCheck]
                  [-ExpandGroups] [-Rescan]
# -Mode values:
#   (omit)  = return LS2Issue objects to the pipeline (default)
#   0       = Emulates Mode 0/no parameters from the original Locksmith: output issues to console as table
#   1       = Emulates Mode 1 from the original Locksmith: output issues + fix scripts to console as list

Find-LS2VulnerableTemplate

Scans certificate templates for specific ESC vulnerabilities.

Find-LS2VulnerableTemplate -Technique <String>
# Supported: ESC1, ESC2, ESC3c1, ESC3c2, ESC4a, ESC4o, ESC9, ESC13

Returns: LS2Issue objects for programmatic use

Find-LS2VulnerableCA

Scans certification authorities for configuration issues and dangerous role assignments.

Find-LS2VulnerableCA -Technique <String>
# Supported: ESC6, ESC7a, ESC7m, ESC8, ESC11, ESC16

Returns: LS2Issue objects for programmatic use

Find-LS2VulnerableObject

Scans PKI infrastructure objects (containers, computer accounts) for security issues.

Find-LS2VulnerableObject -Technique <String>
# Supported: ESC5a, ESC5o

Returns: LS2Issue objects for programmatic use

Get-LS2Stores

Returns internal data stores populated during audits for inspection and analysis.

Get-LS2Stores [-Name <String>]
# Valid -Name values: PrincipalStore, AdcsObjectStore, DomainStore, IssueStore,
#                     SafePrincipals, DangerousPrincipals, StandardOwners
# Omit -Name to return all stores.

Returns:

• PrincipalStore: Resolved principals by SID
• AdcsObjectStore: AD CS objects with security properties
• DomainStore: Domain information
• IssueStore: Discovered vulnerabilities by technique
• SafePrincipals: Acceptable high-privilege SIDs
• DangerousPrincipals: Risky broad-access SIDs
• StandardOwners: Acceptable owner SIDs for AD CS objects

Set-LS2Forest

Sets the target forest for scanning. Useful for running multiple scans or using Find-LS2Vulnerable* functions independently.

Set-LS2Forest -Forest <String>

Set-LS2Credential

Sets credentials for AD queries. Useful for running multiple scans or using Find-LS2Vulnerable* functions independently.

Set-LS2Credential -Credential <PSCredential>

Find-LS2RiskyPrincipal

Pivots from configuration-centric to principal-centric risk analysis. Aggregates vulnerabilities by individual principal to show which users or service accounts have the highest AD CS exposure.

Find-LS2RiskyPrincipal [-Technique <String>] [-MinimumIssueCount <Int>] [-Top <Int>] [-Rescan]

Returns: PSCustomObject with Principal, IssueCount, Techniques, VulnerableObjects, Issues

New-LS2Dashboard

Generates an interactive HTML dashboard from current scan results. PSWriteHTML is included (vendored) — no separate install needed.

New-LS2Dashboard [-FilePath <String>] [-Show] [-ExpandGroups] [-Online]

Returns: HTML file at the specified path. Run Invoke-Locksmith2 or Find-LS2Vulnerable* first to populate the store.

Requirements

• PowerShell: 5.1+
• Permissions: Read access to Active Directory Configuration partition
• Network: Connectivity to domain controller LDAP/GC ports (389, 3268)
• Credentials: Domain user or computer account

Contributing