Exploit ESC8 (ADCS)

List All PKI Enrollment Servers

nxc ldap <ip> -u <username> -p <password> -M adcs

List All Certificates Inside a PKI

nxc ldap <ip> -u <username> -p <password> -M adcs -o SERVER=xxxx

Helpful Resources

{% embed url="https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4" %}

{% embed url="https://github.com/zer1t0/certi" %}

{% embed url="https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse" %}

{% embed url="https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf" %}