ADCSEnumaration

Active Directory Certifcate Services or ADCS provide an alternative way to authenticate within a AD enviroment that contains a PKI as well as being configured with a Certifcate Authority. References below will provide technical info on ADCS as well as exploitation techniques from spectorops certfied preowned white paper.

#Note that we are just enumarating here. We are not preforming exploitation. There is a linux equalivent called certipy that works much the same way
# Find CAs 
C:Tools\Certify.exe cas 

# Find templates
C:Tools\Certify.exe find 

# Find vulnerable templates
C:Tools\Certify.exe find /vulnerable