ADCS Attacks (ESC1–ESC16)

AD CS is the quietest road to Domain Admin: one mis-set checkbox on a certificate template and any user can mint a certificate that authenticates as anyone. The complete, animated ESC1 through ESC16 reference — template misconfigs, CA flags, NTLM relay (PetitPotam), weak certificate mapping, EKUwu (CVE-2024-49019) and the SID-extension attacks — with real Certipy commands, detection and the KB5014754 hardening that closes them.