Listen to this Post
Introduction:
Active Directory Certificate Services (AD CS) is often treated as a “set it and forget it” component of Windows Server infrastructure, but a newly disclosed vulnerability, dubbed “Certighost” (CVE-2026-54121), proves that this oversight can be catastrophic. This improper authorization flaw allows any authenticated domain user—with no administrative privileges whatsoever—to impersonate a Domain Controller, extract the `krbtgt` hash via DCSync, and compromise the entire Active Directory forest. With a public proof-of-concept now available, the window for remediation is rapidly closing.
Learning Objectives:
- Understand the technical mechanics of the Certighost attack chain, including the AD CS “chase” mechanism and PKINIT abuse.
- Learn how to detect and mitigate CVE-2026-54121 through patching, configuration hardening, and active monitoring.
- Gain hands-on knowledge of exploitation techniques and defensive commands for both Linux and Windows environments.
You Should Know:
- Understanding the AD CS “Chase” Mechanism and the Certighost Flaw
Active Directory Certificate Services (AD CS) is Microsoft’s Public Key Infrastructure (PKI) system, issuing X.509 certificates used for encryption, signing, and authentication across a domain. One key use case is certificate-based Kerberos authentication (PKINIT), where a client requests a certificate and later presents it to the Key Distribution Center (KDC) to obtain a Kerberos ticket.
The vulnerability resides in an AD CS enrollment fallback known as a “chase.” When a Certification Authority (CA) cannot directly obtain an end entity’s information, the Windows enrollment protocol allows a request to provide two attributes:
– `cdc` (Client DC): Specifies the Active Directory server the CA should contact.
– `rmd` (Remote Domain): Specifies the machine object to resolve.
The vulnerable CA code blindly trusts whatever host is supplied in the `cdc` attribute without verifying it is an actual Domain Controller. An attacker can stand up rogue SMB/LSA (port 445) and LDAP (port 389) services on their own machine, point the CA at it via cdc, and return fabricated identity data—including a real DC’s SID and DNS hostname—for the `rmd` target. Combined with the default `ms-DS-MachineAccountQuota` setting (which lets any user register up to 10 machine accounts), the attacker’s rogue host can pass the CA’s authentication checks as a “valid” domain principal.
2. Step-by-Step Exploitation Using the Public PoC
The public proof-of-concept tool, available on GitHub, automates the entire attack chain. Below is a detailed walkthrough of how an attacker with only a standard domain user account can compromise the domain.
Prerequisites for the Attacker:
- A standard domain user account (no admin rights required).
- Network reachability to the Enterprise CA and its published services.
- A Linux machine with Python 3 and root privileges (to bind to privileged ports 389 and 445).
Exploitation Steps:
Step 1: Clone the PoC Repository and Install Dependencies
git clone https://github.com/aniqfakhrul/CVE-2026-54121.git cd CVE-2026-54121 pip3 install -r requirements.txt
Step 2: Run the Exploit as Root
The tool must run as root because the rogue LDAP and SMB listeners bind to privileged ports (389 and 445).
sudo python3 certighost.py -d playground.local -u lowpriv -p 'Password1234' --dc-ip 192.168.1.10
What the Script Does Behind the Scenes:
- Creates a Computer Account: The script creates a new computer account (e.g.,
GHOSTABCDEFGH$) or reuses one passed via--computer-1ame. - Starts Rogue Listeners: It starts an SMB/LSA server on port 445 and an LDAP server on port 389.
- Sends a Certificate Request: The script sends a certificate request as that computer account, embedding a custom `cdc` attribute pointing to a controlled IP (via
--listener) plus an `rmd` attribute carrying the target DC’s DNS name. - Relays and Responds: The CA connects back to the rogue LSA/LDAP listeners. They authenticate as the created account (validated through the real DC over Netlogon) and answer the CA’s lookups with the target DC’s identity (sAMAccountName, SID, dNSHostName) instead.
- Certificate Issued: The CA issues a valid certificate belonging to the target Domain Controller.
- PKINIT and DCSync: The script performs PKINIT with the DC’s PFX to request a Kerberos credential cache (
.ccache) and extracts the NT hash via DCSync.
Successful execution writes the target certificate (.pfx) and Kerberos cache (.ccache) to the current directory. The attacker can then use these credentials to perform DCSync, extract the `krbtgt` hash, and forge Golden Tickets for persistent, undetectable access.
3. Detecting Certighost Exploitation in Your Environment
Blue Teams must act swiftly to identify any potential exploitation. Below are key detection strategies and commands.
Windows Event Log Monitoring:
- Event ID 4886 (Certificate Services issued a certificate): Look for unusual machine certificate requests, especially those with unexpected SAN (Subject Alternative Name) values containing Domain Controller identities.
- Event ID 4768 (Kerberos TGT requested): Monitor for TGT requests from machine accounts that should not be authenticating as Domain Controllers.
- Event ID 4662 (Directory Service Access): Detect DCSync operations—look for `DS-Replication-Get-Changes` extended rights being exercised by unexpected accounts.
PowerShell Commands for Detection:
List all certificates issued in the last 24 hours:
Get-EventLog -LogName "Security" -InstanceId 4886 -After (Get-Date).AddDays(-1)
Query the CA database for certificates issued to Domain Controllers:
certutil -view -out "Request ID,Requester Name,Certificate Template,Issued Date" | findstr "DomainController"
Detect potential DCSync activity:
Get-EventLog -LogName "Security" -InstanceId 4662 -After (Get-Date).AddDays(-1) | Where-Object { $_.Message -match "DS-Replication-Get-Changes" }
Linux Commands for Detection (using BloodHound and Certipy):
Enumerate AD CS vulnerabilities and misconfigurations:
certipy find -u [email protected] -p 'Password1234' -dc-ip 192.168.1.10
Check for anomalous certificate templates:
certipy find -u [email protected] -p 'Password1234' -dc-ip 192.168.1.10 -vulnerable
4. Immediate Mitigation: Patching and Workarounds
Primary Mitigation: Apply Microsoft’s July 2026 Security Updates
Microsoft released a patch for CVE-2026-54121 on July 14, 2026. The update introduces a new validation function, _ValidateChaseTargetIsDC, which:
– Rejects empty, oversized, or IP-literal hostnames.
– Blocks LDAP injection characters.
– Queries AD to confirm the target is a real computer object with the `SERVER_TRUST_ACCOUNT` flag.
– Performs a follow-up SID comparison to prevent object substitution before the CA proceeds with the chase and certificate issuance.
Apply the patch immediately on all AD CS servers:
– Windows Server 2012 through Server 2025, including Server Core editions, are affected.
– Download the update from the Microsoft Update Guide.
Temporary Workaround (If Patching Is Not Immediately Possible):
Researchers have documented a lab-tested way to disable the chase fallback when immediate patching is not possible. However, this can break legitimate certificate enrollment workflows and must be validated in a test environment first.
Disable the chase fallback via Registry (use with extreme caution):
reg add "HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration" /v DisableChaseFallback /t REG_DWORD /d 1 /f net stop certsvc && net start certsvc
To re-enable (if needed):
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration" /v DisableChaseFallback /f net stop certsvc && net start certsvc
5. Long-Term Hardening of AD CS Infrastructure
Beyond immediate patching, organizations must treat AD CS as a Tier-0 service and harden it with the same priority as Domain Controllers.
Restrict Machine Account Creation:
The default `ms-DS-MachineAccountQuota` value of 10 allows any domain user to create up to 10 computer accounts—a critical enabler for this attack. Reduce this quota where operationally feasible.
View current MachineAccountQuota:
Get-ADObject -Identity "DC=playground,DC=local" -Properties ms-DS-MachineAccountQuota
Modify the quota (requires Domain Admin):
Set-ADObject -Identity "DC=playground,DC=local" -Replace @{'ms-DS-MachineAccountQuota'=0}
Implement Strict Certificate Template Permissions:
Apply the principle of least privilege to certificate templates, ensuring that only authorized administrators can modify critical templates.
Review certificate template permissions:
certutil -template -v
Network Segmentation:
Restrict network access to Certification Authorities and Domain Controllers to minimize attack exposure. Ensure that only authorized systems can communicate with the CA on ports 389 (LDAP), 445 (SMB), and 636 (LDAPS).
6. Active Monitoring and Incident Response
With a public PoC now available, organizations must assume that unpatched environments are at immediate risk.
Monitor for Suspicious Certificate Enrollment:
- Alert on certificate requests for Domain Controller templates from non-DC machine accounts.
- Monitor for the creation of new computer accounts, especially those with random or suspicious names (e.g.,
GHOST,TEMP).
Detect PKINIT Abuse:
- Look for Kerberos TGT requests (Event ID 4768) where the `Pre-Authentication Type` is `PKINIT` (value 16) and the account is a machine account.
DCSync Detection:
- Enable advanced auditing for Directory Service Access (Event ID 4662).
- Alert on any account performing `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All` extended rights.
Incident Response Checklist:
- Isolate the affected CA server from the network immediately.
- Revoke any suspicious certificates issued by the CA.
- Reset the `krbtgt` account password twice (to invalidate any Golden Tickets).
- Rotate credentials for all Domain Controller machine accounts.
- Conduct a full forensic investigation to determine the scope of compromise.
What Undercode Say:
- Key Takeaway 1: AD CS is a Tier-0 asset and must be patched, monitored, and hardened with the same priority as Domain Controllers. Treating it as a secondary service is a recipe for disaster.
-
Key Takeaway 2: The Certighost vulnerability underscores the danger of trusting client-supplied input in critical authentication flows. The CA’s blind trust in the `cdc` attribute is a textbook example of improper authorization (CWE-285).
Analysis:
The public release of a working exploit for CVE-2026-54121 on July 24, 2026—just ten days after Microsoft’s patch—dramatically shifts the risk landscape. Organizations that have not yet applied the July security updates are now exposed to a trivial, low-skill attack that can lead to full domain compromise. The vulnerability requires no user interaction, no phishing, and no social engineering; a single low-privileged domain account with network access to the CA is sufficient. This is a “fire drill” moment for Windows security teams. The attack chain is fully automated, and the PoC is available on GitHub, lowering the barrier to entry for even novice attackers. The absence of confirmed in-the-wild exploitation as of July 24 does not mean it hasn’t occurred—it simply means defenders have a narrow window to patch before widespread abuse begins. The most concerning aspect is that the vulnerability affects a wide range of Windows Server versions (2012 through 2025), meaning nearly any organization running an internal Microsoft PKI is potentially vulnerable.
Prediction:
- -1: Over the next 30 days, we will see a significant spike in attempted exploitation of unpatched AD CS servers as threat actors integrate the Certighost PoC into their toolkits. Ransomware gangs will particularly favor this attack vector for its speed and stealth.
-
-1: Organizations that fail to patch within the next 72 hours face a high probability of domain compromise. The attack requires minimal resources and leaves few traces, making it attractive for both advanced persistent threats (APTs) and opportunistic cybercriminals.
-
+1: The rapid disclosure and public availability of the PoC will force organizations to finally treat AD CS as a critical security boundary rather than an afterthought. This may lead to broader adoption of PKI hardening best practices and improved security posture across the industry.
-
-1: Security teams that rely solely on patch management without implementing additional detection and hardening measures will remain vulnerable to similar attacks in the future. The Certighost vulnerability is a symptom of deeper architectural trust issues in AD CS that may take years to fully address.
-
+1: Microsoft’s swift patching (within two months of responsible disclosure) and the detailed validation function introduced in the July update demonstrate a maturing vulnerability response process. This sets a positive precedent for future AD CS security improvements.
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=8kpZyrsDWJk
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Muhammad Ahmad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
