heartburn-dev/PKI-Escalate

Quick and dirty PowerShell script to abuse the overly permissive capabilities of the SYSTEM user in a child domain on the Public Key Services and Enrollment Services ADCS containers to obtain Enterprise Administrator from Domain Administrator. Works by enabling a user to perform ESC1 (Enrolee supplying the SAN).

语言：PowerShell · GitHub 星标：29 · Fork：5

在 GitHub 上查看原仓库