Identity
Certipy
Active Directory Certificate Services enumeration and abuse-path analysis for authorized AD CS reviews.
What it is
Certipy enumerates AD CS templates, ESCs, and enrollment rights so you can show whether a low-privilege user can enroll a certificate that impersonates an admin. Prefer find/enum modes. Actual enrollment and authentication with a forged cert is exploitation and needs an RoE line.
Reach for it when
Internal AD assessments where AD CS is in scope and you need to check template security before claiming a path to DA.
Watch-outs
Enrolling certificates creates objects in CA databases that outlive the test if you do not revoke them. Do not request certs for production admins without a cleanup plan. Never leave a client auth cert on disk.
Typical invocation
certipy find -u [email protected] -k -stdout
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- BloodHound
Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
- NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.