Utilises Impacket-RPCDump and attempts to identify ESC8 from an unauthenticated perspective via rpc named pipes. Once web enrollment has been identified, relay using responder/mitm6 ntlmrelayx/certipy. Input either subnet range, hostname or target file with a mixture.

pip install -r requirements.txt