From Misconfigured Certificate Template to Domain Admin :

https://t.co/PTc5mkM70W

Certified Pre-Owned – Abusing Active Directory Certificate Services : https://t.co/cIRt7Hfoml credits @tifkin_ @harmj0y