Samples

Here is the demonstration of the tool I have used for performing an HTB Lab (Retired Machine with Writeup) with ESC1 vulnerability

1. Request and Export certificates via DCOM/SMB with current login user context

2. Certificate stored successfully

3. Used certipy to retrieve TGT and extract NTLM hash (There are other methods such as ldap-shell/Retrieving TGT and inject into current session also works)

4. Logged in as high privilege user