CVE-2022-33679 PoC — Windows Kerberos Elevation of Privilege Vulnerability

Readme

# CVE-2022-33679 Checker

Lightweight checker that tests whether a set of Active Directory credentials is exposed to CVE-2022-33679 (Kerberos AS-REP roast without pre-authentication). The code is derived from [Bdenneu/CVE-2022-33679](https://github.com/Bdenneu/CVE-2022-33679) and keeps only the detection path—**it never attempts exploitation. It isn't an exploit!**.

## Requirements

- Python 3.9+
- Network reachability to the target Domain Controller (TCP/88)
- Optional tooling: [`uv`](https://docs.astral.sh/uv/) for environment management, or standard `python3 -m venv`
- Dependencies listed in `requirements.txt`: `impacket==0.10.0`, `arc4==0.3.0`

## Installation

### Using uv (recommended)

```bash
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt
```

### Using pip

```bash
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
```

## Usage

```bash
uv run python CVE-2022-33679_Checker.py DOMAIN/username [-dc-ip DC_IP] [-ts] [-debug]
```

Argument | Description
---------|------------
`DOMAIN/username` | Credential to test, in `domain/user` format. The domain part is required.
`-dc-ip` | (Optional) IP of the Domain Controller. When omitted, the script resolves the FQDN from `DOMAIN`.
`-ts` | Prefixes logs with timestamps.
`-debug` | Enables verbose logging, including Impacket installation path.

### Notes

- A successful check never sets credentials or resets passwords; it only asks the KDC for an AS-REP without pre-authentication.
- If the supplied user does not exist, the script reports `Usuario no encontrado en el dominio`.
- A vulnerable response causes the script to exit with code `1`; a safe response exits with `0`.

## Examples

Check a user against an explicit DC IP:

```bash
uv run python CVE-2022-33679_Checker.py CONTOSO/alice -dc-ip 192.168.1.10
```

Possible outcomes:

- `Sistema vulnerable a CVE-2022-33679: Se recibió AS-REP sin pre-autenticación`
- `Sistema NO vulnerable: Requiere pre-autenticación Kerberos`

## Troubleshooting

- `Domain should be specified!`: make sure the target is `DOMAIN/user`, not just `user`.
- `Error de Kerberos: ...`: enable `-debug` for more context, verify the DC IP, and confirm the account name.

## Responsible Use

Operate the checker only on systems you are authorized to test. The script is intended for defensive validation of CVE-2022-33679 mitigations.

## References

- [Microsoft Security Response Center CVE-2022-33679](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33679)
- [Bdenneu/CVE-2022-33679](https://github.com/Bdenneu/CVE-2022-33679)

File Snapshot

Remarks