# Exploit ESC8 (ADCS)

### List All PKI Enrollment Servers

```bash
nxc ldap <ip> -u user -p pass -M adcs
```

### List All Certificates Inside a PKI

```bash
nxc ldap <ip> -u user -p pass -M adcs -o SERVER=xxxx
```

### Helpful Resources

{% embed url="<https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4>" %}

{% embed url="<https://github.com/zer1t0/certi>" %}

{% embed url="<https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse>" %}

{% embed url="<https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf>" %}