domains / families / security / relaying-ntlm-for-adcs-esc8

relaying-ntlm-for-adcs-esc8

separate

Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer,

When to use

• During an internal AD penetration test where AD CS with the HTTP Web Enrollment role is present and EPA is not enforced.
• When you have a foothold (even an unauthenticated network position with a coercion vector) and want a path to Domain Admin via certificate impersonation.
• When validating that the organization has mitigated ESC8 (EPA enabled, HTTP enrollment disabled, RPC/EFSRPC coercion patched).
• During purple-team exercises to test detection of coercion + relay + anomalous certificate enrollment.

When not to use

• systems without explicit written authorization
• environments where EPA is enforced

Skill page

Source