ESC8: coerce a DC and relay to AD CS web enrollment
HTTP certificate enrollment plus machine coercion turns any domain foothold into a DC certificate and DCSync.
Tag: adcs
ESC1 certificate template abuse for domain admin
A template that allows enrollee-supplied subject and has a client-auth EKU lets a low-priv user request a cert as any account.
Shadow Credentials for a quiet takeover
Write access to msDS-KeyCredentialLink lets you add your own key and authenticate as the object via PKINIT without touching its password.