Certighost: How A Low-Privileged Domain User Can Clone Your Domain Controller And Own Your Entire Active Directory + Video

Introduction

Active Directory Certificate Services (AD CS) is the backbone of enterprise PKI, responsible for issuing the digital identities that authenticate every user and machine in a Windows domain. On July 24, 2026, security researchers H0j3n and Aniq Fakhrul publicly released a fully working proof-of-concept for CVE-2026-54121—a critical vulnerability they dubbed “Certighost” that allows any authenticated domain user with minimal privileges to impersonate a Domain Controller and compromise the entire Active Directory forest. With a CVSS score of 8.8 and a public PoC now in the wild, this flaw represents one of the most dangerous AD CS attack vectors in recent memory.

Learning Objectives

Understand the technical mechanics of the Certighost vulnerability and how it bypasses AD CS authorization controls
Learn to execute the attack using the public PoC tool in a controlled lab environment
Master detection strategies and forensic indicators to identify exploitation attempts
Implement comprehensive mitigation measures, including patching, configuration hardening, and continuous monitoring

Understanding the “Chase” Mechanism: The Root Cause of CVE-2026-54121

The vulnerability stems from insufficient permission checks during AD CS request handling, specifically within a vulnerable enrollment fallback mechanism known as a “chase” during directory-object resolution. When a Certificate Authority (CA) cannot immediately resolve an end entity’s information through standard channels, it performs a “chase”—a process that queries the directory to locate the target object.

An attacker can manipulate two critical parameters in this process: `cdc` (the AD server to connect to) and `rmd` (the machine object to resolve). By setting `cdc` to an attacker-controlled IP address and `rmd` to the target Domain Controller’s DNS name, the CA is redirected to a rogue SMB/LDAP server that the attacker controls. The CA accepts the forged response without proper validation, issuing a certificate that authenticates the attacker as the Domain Controller itself.

This attack requires no administrative privileges, no user interaction, and only network access to the CA—making it exceptionally dangerous in any environment with default AD CS configurations.

2. Step-by-Step Attack Execution Using the Public PoC

The public PoC, available on GitHub, demonstrates the full exploitation chain. The following steps should only be performed in authorized lab environments for defensive research purposes:

Prerequisites

A low-privileged domain user account (default `ms-DS-MachineAccountQuota` of 10 allows creating up to 10 machine accounts)
Network access to the AD CS server
A Linux system with Python 3 and root privileges (required for binding to privileged ports)

Execution Steps

Step 1: Clone the PoC repository

git clone https://github.com/aniqfakhrul/CVE-2026-54121.git
cd CVE-2026-54121

Step 2: Run the exploit with root privileges

sudo python3 certighost.py -d playground.local -u lowpriv -p 'Password1234' --dc-ip 192.168.1.10

Step 3: The script automates the following attack chain:
1. Creates a new computer account (e.g., GHOSTABCDEFGH$) or reuses an existing one
2. Starts two rogue listeners: an SMB/LSA server on port 445 and an LDAP server on port 389
3. Sends a certificate request embedding a custom `cdc` attribute pointing to the attacker’s controlled IP
4. The CA connects back to the rogue listeners, which authenticate through the real DC and respond with the target DC’s identity (sAMAccountName, SID, dNSHostName)
5. The CA issues a valid certificate belonging to the Domain Controller
6. The script performs PKINIT with the stolen certificate to request a Kerberos ticket cache (.ccache) and extracts the NT hash

Step 4: Successful execution writes two files to the current directory:
– `target_dc.pfx` – The stolen Domain Controller certificate
– `target_dc.ccache` – The Kerberos ticket cache for authentication

Step 5: With these credentials, the attacker can perform a DCSync attack to dump the `krbtgt` hash and all domain secrets, achieving full Active Directory compromise.

Windows-Based Detection Commands

To identify potential exploitation attempts, run the following on your Domain Controllers and CA servers:

 Check for unexpected certificate issuance events
Get-WinEvent -LogName "Security" | Where-Object { $<em>.Id -eq 4886 -or $</em>.Id -eq 4887 } | 
Select-Object TimeCreated, Message | Where-Object { $_.Message -like "Domain Controller" }

Audit computer account creation spikes
Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=4741]]" | 
Select-Object TimeCreated, @{Name="Account";Expression={$_.Properties[bash].Value}}

Check for unusual Kerberos PKINIT authentication
Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=4768]]" | 
Where-Object { $_.Message -like "PKINIT" }

3. Immediate Mitigation: Patching and Temporary Workarounds

Microsoft patched CVE-2026-54121 in the July 14, 2026 security updates. The following actions are critical:

Primary Mitigation: Apply the Patch

Deploy the July 2026 security update to all CA servers immediately
The patch addresses the improper authorization flaw in the certificate enrollment process

Temporary Workaround (If Patching Is Not Immediately Possible)

The following registry modification disables the vulnerable “chase” mechanism:

certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC

Important: After running this command, restart the Certificate Services service:

net stop certsvc && net start certsvc

This workaround prevents the CA from performing the directory chase that the vulnerability exploits, effectively blocking the attack until the patch can be applied.

Additional Hardening Measures

Disable unused AD CS enrollment interfaces – Reduce the attack surface by decommissioning unnecessary certificate templates and enrollment pages
Enforce manager approval for sensitive certificate templates – Add an approval workflow for templates that can issue Domain Controller-equivalent certificates
Restrict AD CS administration to Tier 0 accounts – Apply the Microsoft ESAE (Enhanced Security Administrative Environment) model to segregate privileged access
Audit all certificate templates – Review and restrict enrollment permissions to only necessary security groups

4. Detection Engineering: Identifying Certighost Exploitation

Given that the public PoC is now widely available, proactive detection is essential. Security teams should implement the following monitoring strategies:

Key Indicators of Compromise (IoCs)

| Indicator | Description |

|–|-|

Linux-Based Detection Script

For environments with centralized logging, the following Python script can parse CA logs for suspicious patterns:

import re
import sys

Parse CA audit logs for suspicious enrollments
def detect_certighost(log_file):
suspicious_patterns = [
r"Template.Domain Controller",
r"Requestor.computer account",
r"Enrollment.non-administrative user"
]

with open(log_file, 'r') as f:
for line in f:
for pattern in suspicious_patterns:
if re.search(pattern, line, re.IGNORECASE):
print(f"[bash] Potential Certighost activity: {line.strip()}")

if <strong>name</strong> == "<strong>main</strong>":
detect_certighost(sys.argv[bash])

Windows Event Log Monitoring

Deploy the following Advanced Audit Policy settings to capture detailed certificate enrollment events:

 Enable detailed certificate services auditing
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

Configure SACL on the CA configuration container
dsacls "CN=Configuration,DC=domain,DC=local" /G "Domain Admins:GA" /I:T

5. Active Directory Hardening: Preventing Similar Vulnerabilities

The Certighost vulnerability highlights systemic weaknesses in AD CS security. Organizations should implement a comprehensive hardening program:

Principle of Least Privilege for Certificate Templates

Review and restrict all certificate templates:

 List all certificate templates and their permissions
Get-ADObject -Filter {objectClass -eq "pKICertificateTemplate"} -Properties  | 
Select-Object Name, @{N="Enrollment Permissions";E={$_.pKIExtendedKeyUsage}}

Implement Certificate Manager Approval

For high-value templates (Domain Controller, Domain Admin, etc.):

 Enable manager approval for a template
certutil -setreg CA\Template\DomainController\mFlags +CT_FLAG_MANAGER_APPROVAL

Network Segmentation

Isolate CA servers in a dedicated management network
Restrict inbound connections to CA servers to only authorized administrative workstations
Implement IPS/IDS rules to detect SMB and LDAP connection attempts from CA servers to non-domain IP addresses

What Undercode Say

Key Takeaway 1: The Certighost vulnerability (CVE-2026-54121) demonstrates that AD CS, often overlooked in security assessments, can be a critical attack vector. Any authenticated domain user—not just administrators—can escalate to full domain compromise with a single misconfigured certificate template and the vulnerable “chase” mechanism.
Key Takeaway 2: The public release of a working PoC on July 24, 2026—just ten days after Microsoft’s patch—dramatically lowers the barrier to exploitation. Organizations that have not yet applied the July 2026 security updates are at immediate, elevated risk of compromise. The temporary workaround (-EDITF_ENABLECHASECLIENTDC) should be applied immediately if patching is delayed.
Analysis: This vulnerability is particularly dangerous because it exploits a core AD CS enrollment feature rather than a simple configuration error. The “chase” mechanism was designed for resilience but introduced an authorization bypass that allows a CA to be tricked into trusting external responses. The attack chain—from low-privileged user to Domain Controller certificate to DCSync—is remarkably short and requires no user interaction, making it ideal for automated exploitation. Security teams must treat this as a “patch now” priority, conduct thorough audits of all certificate templates, and implement continuous monitoring for the IoCs described above. The fact that the vulnerability was discovered and responsibly disclosed by independent researchers underscores the importance of community-driven security research in protecting enterprise infrastructure.

Prediction

-1 Expect a surge in opportunistic exploitation attempts within 48–72 hours of the PoC release, particularly targeting organizations with exposed CA servers and default AD CS configurations. Attackers will automate the PoC into broader exploit frameworks.
-1 Ransomware groups will likely incorporate Certighost into their initial access toolkits, using it to gain Domain Admin privileges before deploying encryption payloads, significantly accelerating the time-to-compromise in Active Directory environments.
+1 The vulnerability will drive increased adoption of AD CS monitoring solutions and Zero Trust architectures that treat certificate issuance as a high-risk event requiring continuous validation.
+1 Microsoft will likely release additional guidance and possibly a more comprehensive fix in future updates, potentially including behavioral detection for the “chase” abuse pattern.
-1 Organizations with complex AD CS deployments and legacy certificate templates may face significant challenges in remediation, as auditing and restructuring enrollment permissions can be a time-consuming process that leaves them exposed in the interim.

▶️ Related Video (74% Match):

https://www.youtube.com/watch?v=7bJBdwym-8I

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Nusretonen Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post