relaying-ntlm-for-adcs-esc8

Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT/DCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.