CVE

CVE-2022-33679 is an unauthenticated Kerberos encryption-downgrade attack: the KDC returns AS-REP material encrypted with the legacy RC4-MD4 (etype 24) cipher for an account, and a known-plaintext weakness lets the attacker brute-force the ephemeral session key and forge a usable TGT. Bdenneu's standalone exploit targets a domain account that has 'Do not require Kerberos pre-authentication' set and an RC4 key, needing only the victim's username (no password). It writes the recovered TGT to a ccache named <user>_<server>.ccache, which can then be used for unauthenticated Kerberoasting or further access. Command Reference: Target (domain/user): test.local/john DC host: dc.test.local DC IP: 10.10.10.1 Output: out.ccache

# target = domain/username (AS-REP-roastable account), serverName = DC FQDN
python3 CVE-2022-33679.py test.local/john dc.test.local -dc-ip 10.10.10.1

# Use the recovered ticket
export KRB5CCNAME=john_dc.ccache

Native

Credential Access, Exploitation

Requires

No_Creds

Services

Kerberos

Refs

github.com/Bdenneu/CVE-2022-33679

googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html

horizon3.ai/attack-research/attack-blogs/from-cve-2022-33679-to-unauthenticated-kerberoasting/