---
id: 3160
title: "Becoming the Machine, A Virtual Account's Guide to Total Control"
source_domain: abdulmhsblog.com
source_url: "http://abdulmhsblog.com/posts/iammachine/"
published_at: "2025-10-13 00:00"
tags: ["active-directory", "privilege-escalation", "adcs", "virtual-account", "mssql", "pkinit", "silver-ticket"]
phying_url: "https://phying.com/item/3160"
lang: en
---

# Becoming the Machine, A Virtual Account's Guide to Total Control

## Summary

Presents an ADCS takeover path: from a MSSQL virtual account, enroll a machine certificate with certreq, recover the machine account NTLM hash via PKINIT, then use S4U2SELF for a silver ticket.

## Intelligence Metadata

- **Sources:** abdulmhsblog.com
- **Published:** 2025-10-13 00:00
- **Original:** http://abdulmhsblog.com/posts/iammachine/
- **Phying News:** https://phying.com/item/3160