Relay to HTTP AD CS (ESC8)

Try this certipy relay thing:

https://www.vaadata.com/blog/ad-cs-security-understanding-and-exploiting-esc-techniques/#aioseo-exploitation-conditions-and-attack-sequence