7MS #716: Tales of Pentest Pwnage – Part 83

Today is my favorite pentest pwnage tale of 2026 – and maybe ever! It centers around an ADCS abuse via an attack path I'd never seen before. Tips include:

• Use Netexec to pull Powershell history
• Trying to steal reg hives and the EDR is made? Try copying them out to \\some-other-server.domain.com\share
• This post featured interesting use of the Responder -N option