AD CS Abuse

Check for AD CS vulnerabilities related to specific user or machine

Search for all ADCS vulnerabilities related to a specific user. Show enabled and vulnerable templates only.

certipy find -u '<user_or_machine$>@<domain>' -p '<password>' -dc-ip <dc_ip> -enabled -vulnerable

Certipy Flags

Flag	Description
-enabled	Only show templates that are enabled.
-vulnerable	Only show templates that are vulnerable from the user specified in `-u'