https://blog.iamwin.xyz/tags/krbrelay/Recent content in KrbRelay on IamWin's BlogHugoen-usTue, 30 Jun 2026 01:08:00 -0500https://blog.iamwin.xyz/posts/esc8_krb/Tue, 30 Jun 2026 01:08:00 -0500https://blog.iamwin.xyz/posts/esc8_krb/<h2 id="summary">Summary</h2> <p><strong>ESC8</strong> is an AD CS vulnerability where the Certificate Enrollment Web Service is enabled over <strong>HTTP</strong> (without HTTPS). This allows intercepting a Domain Controller&rsquo;s authentication and relaying it to the CA to request a certificate. With that certificate we can impersonate the DC, perform DCSync, and take full control of the domain.</p> <h2 id="requirements">Requirements</h2> <ul> <li>Valid domain user credentials (<code>Rosie.Powell:Cicada123</code>)</li> <li>The CA has Web Enrollment over HTTP enabled</li> <li>NTLM disabled in the domain (authentication must use Kerberos)</li> <li>Machine Account Quota &gt; 0 (allows adding DNS records, default is 10)</li> </ul> <h2 id="step-by-step-walkthrough">Step-by-step Walkthrough</h2> <h3 id="1-initial-setup">1. Initial Setup</h3> <p>Ensure correct DNS resolution in <code>/etc/hosts</code>:</p>