yowise/cve-2022-26923Detailed technical write-up and proof-of-concept for CVE-2022-26923, an Active Directory Certificate Services privilege escalation vulnerability, including exploitation steps and mitigation insights.
As described by Tenable: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS v3
Base score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: High
CVE-2022-26923 exploits a vulnerability in Microsoft Active Directory Certificate Services (AD CS) to elevate privileges.
Certificate Templates: AD CS offers two default templates for certificate requests: User and Machine.
User Template Limitation: The User template is not vulnerable because it embeds the user's UPN in the SAN, which is unique and cannot be easily modified.
Machine Template Vulnerability: The Machine template uses the DNS Name for identification. By modifying the DNS Name of a newly enrolled host to match a Domain Controller, an attacker can obtain a certificate that allows impersonation of the Domain Controller.
Privilege Escalation: This impersonation can be used to elevate privileges and gain control over the Active Directory domain.
Microsoft defines Active Directory Certificate Services (AD CS) as, "...the server role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization."
A certificate is an X.509-formatted digitally signed document used for encryption, message signing, and/or authentication. A certificate typically has various fields, including some of the following:
- Code Signing (OID 1.3.6.1.5.5.7.3.3) - The certificate is for signing executable code.
- Encrypting File System (OID 1.3.6.1.4.1.311.10.3.4) - The certificate is for encrypting file systems.
- Secure Email (1.3.6.1.5.5.7.3.4) - The certificate is for encrypting email.
- Client Authentication (OID 1.3.6.1.5.5.7.3.2) - The certificate is for authentication to another server (e.g., to AD).
- Smart Card Logon (OID 1.3.6.1.4.1.311.20.2.2) - The certificate is for use in smart card authentication.
- Server Authentication (OID 1.3.6.1.5.5.7.3.1) - The certificate is for identifying servers (e.g., HTTPS certificates).
Source: specterops' whitepaper
Digital certificates can be used to encrypt and digitally sign electronic documents and messages as well as for authentication of computer, user, or device accounts on a network. For example, digital certificates are used to provide:
🔐Confidentiality through encryption.
🔏Integrity through digital signatures.
🖇️Authentication by associating certificate keys with the computer, user, or device accounts on a computer network.
Source: Microsoft Learning
AD CS is a Microsoft technology that provides a centralized infrastructure for managing digital certificates. It offers several key benefits:
Identity Binding: AD CS binds identities (users, computers, services) to private keys, ensuring secure authentication and access control.
Certificate Management: It efficiently manages the distribution, enrollment, and revocation of certificates.
Integration with Active Directory: Leverages existing identity information in AD for seamless certificate registration and management.
Group Policy Configuration: Allows for fine-grained control of certificate issuance and usage based on roles or attributes.
Supports Various Applications: AD CS supports a wide range of applications, including S/MIME, wireless networks, VPN, IPsec, EFS, smart cards, SSL/TLS, and digital signatures.
In essence, AD CS provides a secure and efficient way to manage digital certificates, enhancing the overall security of an organization's IT infrastructure.
