Tag: ESC8

All the articles with the tag "ESC8".

• ShadowGate — HackSmarter Pro Labs

  21 Sep, 2026

  ShadowGate writeup (HackSmarter Pro Labs): anonymous AD enumeration, AS-REP Roasting, Shadow Credentials with Certipy, ESC8 and DCSync.

• Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)

  30 Jun, 2026

  Deep dive into exploiting ADCS ESC8 via Kerberos Relay using KrbRelay to obtain domain controller certificates and achieve domain takeover.

• Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)

  9 Jun, 2026

  Step-by-step walkthrough of ADCS ESC8 exploitation over HTTP Web Enrollment using NTLM Relay for full Active Directory domain escalation.