adcs-certipy-attack

SUSPICIOUS. The skill is internally coherent as an ADCS attack skill, but its purpose is offensive exploitation by an AI agent: credential use, relay, certificate theft/forgery, LDAP modification, DCSync, and persistence all fit that purpose. The main install path evidence points to real upstream tools rather than a fake payload, so this is not confirmed malware, but it is a high-risk exploit capability for an agent and forwards sensitive creds/cert material into multiple third-party tools with limited version pinning.

The fragment is a high-risk Active Directory attack guide. It documents actionable procedures for NTLM relay, ADCS certificate theft, PKINIT and NTLM hash extraction, DCSync, LDAP privilege escalation, RBCD, backdoor account creation, and golden-certificate persistence. It does not itself appear to contain executable malware or obfuscated code, but inclusion in a software package would be suspicious and could materially enable unauthorized compromise.

该片段不是软件源代码，而是一份明确的 ADCS 攻击与持久化操作指南。其内容包含窃取 CA 私钥、伪造任意身份证书、绕过 Kerberos 进行 LDAP 管理、创建后门账户、修改 RBCD、读取 LAPS 以及破解 PFX 密码等高危步骤。虽然片段本身不会执行恶意行为，但若作为攻击工具文档或操作手册使用，会显著促进域环境接管和长期持久化。

该内容不是恶意软件代码，也未显示供应链植入或数据窃取行为；但它是高度可操作的 AD CS 权限提升与凭据/证书获取攻击指南。若在未授权环境执行，可能导致域管理员或域控级别的未授权认证。应仅用于获得授权的安全测试，并优先修复可写模板、过宽 CA 权限、未保护的 ICPR RPC 和不必要的 NTLM 认证。

未提供可供进行软件供应链恶意代码审查的源代码；提供的是 CVE-2022-26923 的域控提权攻击指南。其命令链明确支持证书欺骗、PKINIT 认证和 DCSync，若在真实域环境执行会造成严重安全影响，但无法据此判断某个 npm 或其他软件包包含恶意代码。