Domain privilege escalation
In this section, we will explore practical techniques to escalate privileges by exploiting various security issues, such as template and extension misconfigurations (ESC1, 2, 3, 9, and 10), improper access controls (ESC4, 5, and 7), CA misconfiguration (ESC6), and relay attacks (ESC8 and 11). I have chosen such a grouping of the attacks from[12]. But to begin with, we will start with a critical vulnerability discovered by Oliver Lyak, called Certifried, which evolves into ESC9 and ESC10 after the patch.
Certifried (CVE-2022-26923)
This vulnerability has much in common with samAccountName spoofing (CVE-2021-42278). Original research by the author is published here[13].
In AD CS, by default, there are two authentication certificates: user and machine. Every user account has a User Principal Name (UPN) that must be unique. The UPN is embedded into the certificate and used by KDC during authentication. Computer accounts do not have a UPN, as dNSHostName...
