# 利用 ESC8 (ADCS)

### 列出所有 PKI 注册服务器

nxc `ldap <ip> -u user -p pass -M adcs`

### 列出 PKI 中的所有证书

nxc `ldap <ip> -u user -p pass -M adcs -o SERVER=xxxx`

### 有用的资源

{% embed url="<https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4>" %}

{% embed url="<https://github.com/zer1t0/certi>" %}

{% embed url="<https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse>" %}

{% embed url="<https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf>" %}