> For the complete documentation index, see [llms.txt](https://xedex.gitbook.io/internalpentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/initial-attack-vectors/adcs-+-petitpotal-ntlm-relay.md).

# ADCS + PetitPotal NTLM Relay

Already explained pretty well in these both articles :

{% embed url="<https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/adcs-+-petitpotam-ntlm-relay-obtaining-krbtgt-hash-with-domain-controller-machine-certificate>" %}

{% embed url="<https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory/>" %}