Certipy
Attack Active Directory Certificate Services.
KaliParrothigh
pkg: certipy
Certipy enumerates and abuses AD CS misconfigurations (ESC1-ESC8) to escalate to Domain Admin.
Syntax
certipy {find|req|auth} [options]
Example
certipy find -u user@corp.local -p P@ss -dc-ip 10.0.0.1
Enumerates vulnerable certificate templates.
Advantages
- Powerful AD CS attack suite
- Covers ESC1-ESC8
Disadvantages
- Deep AD knowledge required
- Highly intrusive
Tags
#ad#adcs#privesc
Official docs: Certipy ↗
Related commands
Frequently asked questions
What is Certipy used for?
Certipy enumerates and abuses AD CS misconfigurations (ESC1-ESC8) to escalate to Domain Admin.
What is an example Certipy command?
A common example is: certipy find -u user@corp.local -p P@ss -dc-ip 10.0.0.1 — Enumerates vulnerable certificate templates.
Is Certipy part of Kali Linux?
Yes. Certipy ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install certipy.
What category of security tool is Certipy?
Certipy is a Post-Exploitation tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.