Loading vulnerability…
CVE-2022-26923, also known as Certifried, is a critical elevation-of-privilege vulnerability in Active Directory Domain Services that affects environments using Active Directory Certificate Services for certificate-based authentication. The issue arises from improper validation during certificate issuance and mapping for computer accounts, allowing an authenticated domain user to manipulate attributes on a computer account they control, particularly the DNS host identity associated with that account, and obtain a certificate that can be used to impersonate a more privileged machine identity such as a domain controller. Reported descriptions of the flaw note that certificate-based authentication logic did not properly account for machine-account naming semantics, including the trailing dollar-sign convention, and did not sufficiently bind the certificate identity to the correct security principal. Successful abuse can let an attacker authenticate as the spoofed machine account and use that trust position to escalate privileges within the domain.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository is a small standalone Bash exploit project containing one executable script and a README. The main file, cve_2022_26923.sh, automates exploitation of CVE-2022-26923 ('Certifried') in Microsoft Active Directory environments with AD CS enabled. It is not a framework module; it is a wrapper/orchestrator around external offensive tooling including certipy-ad, bloodyAD, Impacket utilities, and openssl. Repository structure: README.md documents the attack chain, dependencies, usage, and expected output. cve_2022_26923.sh is the operational exploit entry point. The script includes argument parsing, a helper to optionally print commands, connectivity testing, attack execution, and an EXIT/INT/TERM cleanup trap. Primary exploit flow: the script first creates a random machine account, then updates its dNSHostName to impersonate the Domain Controller hostname. It polls LDAP via certipy-ad account read to wait for synchronization, then requests a machine certificate from the configured AD CS CA/template. If certificate issuance succeeds, it attempts classic Certifried exploitation by authenticating with the PFX via certipy-ad auth and parsing output for the DC machine account hash. On success, it runs impacket-secretsdump with the recovered hash to DCSync the administrator account. Fallback flow: if direct PKINIT/hash recovery fails, the script converts the PFX to PEM, uses bloodyAD to grant Resource-Based Constrained Delegation on the DC to the attacker-controlled machine account, adds a cifs SPN to that machine account with impacket-addspn, requests an S4U2Self/S4U2Proxy service ticket for the administrator account using impacket-getST, exports the resulting Kerberos ccache, and finally runs impacket-secretsdump with Kerberos authentication to dump NTLM data for the administrator account. Capabilities: automated AD object manipulation, certificate enrollment abuse, PKINIT-based authentication, NTLM hash extraction, RBCD configuration, SPN manipulation, Kerberos S4U ticket acquisition, and DCSync. The script also performs basic OPSEC cleanup by removing RBCD, deleting the created machine account, and wiping local certificate/key/ccache artifacts. Notable implementation details: the script hardcodes lab defaults (DC IP 10.129.227.189, domain certifried.htb, user steven.murray@certifried.htb, password Ch4ng3m3!, CA certifried-DC-CA, template Machine), but these can be overridden via CLI options. It retries certificate requests up to five times when encountering a NETBIOS timeout. The exploit is operational rather than weaponized because it provides a complete attack chain but relies on fixed external tools and mostly hardcoded/default parameters rather than a reusable framework.
Repository contains a single operational Bash exploit script plus a README. - Files: - CVE-2022-26923.sh: end-to-end automation of the “Certifried” (CVE-2022-26923) AD CS abuse chain. - README.md: explains the attack steps, dependencies, and example usage (HTB/lab oriented). - Exploit purpose/flow (as implemented): 1) Verifies DC reachability (ping to DC_IP). 2) Uses certipy-ad to create an attacker-controlled computer account (default PWNED$) with a chosen password. 3) Updates that computer object’s dNSHostName to spoof the DC hostname (default dc.certifried.htb), aligning with Certifried technique. 4) Requests a certificate from AD CS (default template: Machine; CA: certifried-DC-CA) as the spoofed machine account, expecting a PFX (default dc.pfx). 5) Authenticates using the obtained PFX (certipy-ad auth). 6) Converts PFX to PEM (dc.pem) and uses bloodyAD with client-certificate auth to configure Resource-Based Constrained Delegation (RBCD) on the DC computer account (default target: dc$) to allow delegation from the attacker-controlled machine. 7) Uses Impacket getST.py to perform S4U (impersonate default: administrator) to obtain a Kerberos service ticket (SPN LDAP/dc.certifried.htb), extracting the generated ccache path from tool output. 8) Copies the ccache to /tmp and runs Impacket secretsdump.py with Kerberos auth (-k -no-pass) to dump NTLM material for the impersonated account (default administrator) from the DC. - Notable characteristics: - Hardcoded lab defaults (DC IP/domain/user/pass/CA/template) but supports CLI overrides. - Relies on external tooling for all protocol interactions; the script is an orchestrator rather than a standalone exploit implementation. - Output/impact: credential material extraction (NTLM hash dump) and Kerberos ticket artifacts (ccache), enabling domain compromise in vulnerable configurations.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Active Directory Certificate Services-related vulnerability referenced in the context of Microsoft’s Certifried mitigation, affecting certificate-based identity mapping by requiring SID checks against SAN identities.
Unknown
Specific Microsoft Windows vulnerability referenced in KB 5013945 for Windows 10 1909; exploit availability is indicated in the content.
Specific Microsoft Windows vulnerability referenced in the advisory for Windows 10 1507 / KB5013963.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.