AD Certificate Services ESC1 Abuse with Certipy

Hard OffSec OSCP cybersecurity drill: You are conducting an authorized penetration test against Contoso Corp (contoso.local). With a low-privilege domain