Enumerate every CA/template in Active Directory Certificate Services (ADCS) and flag which ESC misconfigurations apply, based on the authenticated user’s actual group memberships.
Authenticate with an issued certificate — returns a Kerberos ccache and, if StrongCertificateBindingEnforcement allows it, the account’s NT hash via PKINIT (U2U).
Active Directory - Shadow Credentials Attack end-to-end: adds a Key Credential, requests a certificate through it, and authenticates — no separate pywhisker/PKINITtools chain needed.
certipy-ad ca -u '<user>@<domain>' -p '<pass>' -ca '<ca_name>' -list-templates
List every template published on a specific CA.
Tips & Tricks
find -vulnerable only flags what the authenticated account can actually reach — re-run it after every new credential gained during an engagement, same as BloodHound collection.
-hashes and -k (Kerberos/ccache) work everywhere -p does — once one identity’s certificate is obtained via PKINIT, the resulting ccache chains straight into the next certipy-ad command without ever touching a plaintext password.
certipy-ad auth fails to return an NT hash (only a TGT) when StrongCertificateBindingEnforcement is set to 2 and the certificate carries no strong SID mapping — that gap is exactly what ESC9/ESC10 exist to route around.