NTLM relay to ADCS: ESC8 from a standing start
Relaying NTLM to Active Directory Certificate Services web enrollment to mint a DC certificate and DCSync.
Oct 01, 2026·13 min read·High difficulty·Lab derived
- #ADCS
- #ESC8
- #NTLM Relay
- #Active Directory
§Status
Placeholder restored after the content migration. Replace with the original writeup when available. "
Written by
MJ — offensive security researcher
I break things in a lab so defenders can build better controls. Everything published here is lab-derived, responsibly disclosed, and documented with the detection path in mind.