Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipy -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipy -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/exploiting-adcs-with-certipygh skill install mukul975/Anthropic-Cybersecurity-Skills exploiting-adcs-with-certipygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-adcs-with-certipy ~/.claude/skills/exploiting-adcs-with-certipy # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-adcs-with-certipy ~/.agents/skills/exploiting-adcs-with-certipy # Codex, Cursor, Gemini CLI, Copilot, OpenCode