AD CS ESC8: NTLM Relay to Web Enrollment

ESC8 is an AD CS exposure in which NTLM authentication is relayed to a Certificate Authority Web Enrollment or Certificate Enrollment Web Service endpoint that lacks effective relay protection. A tester who can cause an in-scope account to authenticate to a relay listener may obtain a client-authentication certificate for that same account when it can enroll in a published eligible template and the CA is trusted for domain authentication. A Domain Controller certificate can provide authentication as that machine account, but success depends on coercion, template and enrollment permissions, issuance policy, CA trust, and endpoint protections. The relay forwards an NTLM authentication exchange; it does not itself recover the victim's password or NTLM hash, and DCSync is a separate follow-on requiring additional conditions.