heartburn-dev / PKI-Escalate
Quick and dirty PowerShell script to abuse the overly permissive capabilities of the SYSTEM user in a child domain on the Public Key Services and Enrollment Services ADCS containers to obtain Enterprise Administrator from Domain Administrator. Works by enabling a user to perform ESC1 (Enrolee supplying the SAN).
☆25Updated last year
Alternatives and similar repositories for PKI-Escalate:
Users that are interested in PKI-Escalate are comparing it to the libraries listed below
- Scripts to interact with Microsoft Graph APIs☆36Updated 5 months ago
- SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Dire…☆33Updated 10 months ago
- ☆43Updated 9 months ago
- Extract registry and NTDS secrets from local or remote disk images