ADCS: Playing with ESC4
Shadow Credentials: Workstation Takeover Edition
Lateral Movement with LiquidSnake
PKINIT FTW - Chaining Shadow Credentials and ADCS Template Abuse
Elevating with NTLMv1 and the Printer Bug
SOCKS Proxy Relaying
SharpInjector
Experimenting with Kerberos Ticket Formats