Impacket ntlmrelayx (SMB→ADCS)

ntlmrelayx.py -t http://<ca>/certsrv/certfnsh.asp --adcs --template DomainController

Relay NTLM authentications to ADCS to request a domain certificate (ESC8).

When you have captured NTLM authentication from a host (e.g., DC) and want to obtain an ADCS certificate that allows authentication as that host. It's the ESC8 technique: relay to the certificate web interface.

If ADCS does not have the web interface enabled (certsrv). Also if the DC has SMB signing enforced.