Exploiting Misconfigured ADCS: ESC8

preview_player
Показать описание
Corrections:
At 4:32, it is using that certificate of the machine account.

Commands Used:
4) lsadump::dcsync /domain:BERSERK.local /all /csv
Рекомендации по теме
Комментарии
Автор

How did you know that the endpoint for ntlmrelayx was /certsrv/certfnsh.asp? Or is it that way by default? Thanks.

pablograffigna
join shbcf.ru