Weaponize a dangling AD CS certificate template via CreateChild rights — create the missing template object preconfigured for ESC1 (ENROLLEE_SUPPLIES_SUBJECT + Client Auth + custom enrollment ACL).
ldap active-directory pentesting esc privilege-escalation red-team impacket oscp hackthebox adcs windows-security esc1 ad-cs certificate-template pkinit certipy domain-escalation bloodyad dangling-template
-
Updated
Nov 3, 2026 - Python