AD CS enumeration & abuse: ESC1-ESC16, certificate requests, PKINIT / UnPAC-the-hash, shadow credentials & golden certs