利用 ESC8 (ADCS)

列出所有 PKI 注册服务器

nxc ldap <ip> -u user -p pass -M adcs

列出 PKI 中的所有证书

nxc ldap <ip> -u user -p pass -M adcs -o SERVER=xxxx

有用的资源

https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4www.fortalicesolutions.com

GitHub - zer1t0/certi: ADCS abuserGitHub

https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuseppn.snovvcrash.rocks