Certipy
Enumerates and abuses AD CS certificate templates (ESC1-ESC16).
The reference tool for Active Directory Certificate Services (AD CS). It finds misconfigured certificate templates (ESC1 to ESC16), requests certificates abusing them and authenticates with the resulting .pfx to obtain the victim's NT hash or a TGT, often Administrator itself.
Family AD abuse (ACL, ADCS, coercion)
Flags find auth req shadow
Concepts ADCS ESC9 (No Security Extension), GenericAll, GenericWrite
Cheatsheet AD CS (certificates)
Installation
pipx install certipy-adUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- CertifiedHackTheBox