Red Team Operations
Ctrlk
LinkedInGitHub
  • Red Teaming Lifecycle
  • Lab
  • Executing PowerShell
  • Domain Enumeration
    • PowerView
    • ActiveDirectory Module - OPSEC
    • User Hunting
    • GPOs & OUs
    • ACL
    • Trusts
    • BloodHound
  • Lateral Movement
    • PowerShell Remoting (WinRM)
    • Invoke-Mimikatz
    • File Transfers
    • Derivative Local Admin (Concept)
  • AV Evasion
    • PowerShell Scripts
    • Offensive .NET
    • Payload Delivery
  • Windows Privilege Escalation
    • Checklist
    • Initial Enumeration Manual
    • Initial Enumeration Automated
    • Service Permissions
    • Kernel Exploits
    • DLL Hijacking
    • Impersonation and Potato Attacks
    • Registy
    • whoami /priv
    • Scheduled tasks
    • xampp
    • Stored Passwords and Port Forwarding
    • RunAs
    • User Switching
    • Executable Files
    • Startup Applications
    • getsystem
    • Windows Subsystem for Linux
    • CVE-2019-1388
    • CVE-2024-26229 (new)
  • Enterprise Applications
    • Jenkins
  • Active Directory
    • Checklist
    • Initial Attack Strategy
    • Post-Compromise Enumeration
    • Lateral Movement
    • Post-Compromise Attacks
      • Kerberoasting
      • Silver Ticket
      • noPac or noCap ?
      • RPC Password Change
      • Mimikatz
      • Knock and Pass Kerberos
      • Dumping and Cracking Hashes
      • Token Impersonation
      • LNK File Attacks
      • GPP / cPassword Attacks
      • AD CS Attacks
      • misc
    • Post-Domain Compromise
    • Critical Active Directory CVE's
  • Post Exploitation
    • C2
    • AV Evasion
    • Exfiltration
    • Pivoting
    • File Transfers
    • DNS Tunneling
    • Persistence
    • PGP/ASC
    • Putty
    • Cleanup
  • Cool!
    • Client-side Attacks
    • Custom Wordlists
    • Fixing Exploits
    • Decrypting Secure Strings
    • tmux
    • Random
  • Report Writing
    • Findings Report
    • Common Legal Documents
Powered by GitBook
On this page
  1. Active Directory
  2. Post-Compromise Attacks

AD CS Attacks

LogoAbusing Active Directory Certificate Services (Part 1) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.
LogoExploiting Active Directory Certificate Services (AD CS)Redfox Security - Pen Testing Services

certipy-ad find -u [email protected] -p pass -dc-ip 192.168.204.30 -vulnerable -enabled

certipy-ad req -u jodie.summers -p pass -target nara-security.com -ca NARA-CA -template NARAUSER -upn [email protected]

PreviousGPP / cPassword AttacksNextmisc