Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Certighost exploit lets a domain user obtain a Domain Controller certificate and reach DCSync through a vulnerable AD CS chase.
More info