Exploit ESC8 (ADCS)

List All PKI Enrollment Servers

nxc ldap <ip> -u user -p pass -M adcs

List All Certificates Inside a PKI

nxc ldap <ip> -u user -p pass -M adcs -o SERVER=xxxx

Helpful Resources

ADCS: Playing with ESC4

GitHub - zer1t0/certi: ADCS abuserGitHub

AD CS AbusePentester's Promiscuous Notebook