Let’s Discusses how the process of Requesting Certificate Occurs

1. Client Generate Public/Private Key pair

2. Client Sends a Certificate Request to Enterprise CA Server

3. The CA Servers validate is the Certificate Template exist and is the user allowed to enroll to this cert

4. CA Generates a Certificate and signs it using Private Key

5. The User Stores the Certificate In the Windows Certificate Store

What Attacker Can do if we Abused ADCS?

Take A Look at all those techniques

Try Harder We ain’t done yet

Escalation

ESC1