Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.

They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.

Microsoft patched the Active Directory Certificate Services (AD CS) issue ten days earlier as CVE-2026-54121. Microsoft classed the flaw as improper authorization and assigned it a CVSS score of 8.8.

Exploitation requires network access and a domain account, but no administrator rights or user interaction. In the researchers’ test, a normal Domain Users account could create a computer account under the default ms-DS-MachineAccountQuota value of 10 or reuse one it already controlled.

The chain also required an Enterprise CA that followed the vulnerable chain path, enrollment through the default Machine template, and network reachability from the CA to the attacker’s SMB and LDAP listeners.

Organizations running an Enterprise CA should install Microsoft’s July 14 updates on AD CS hosts. As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild, but the full proof-of-concept was public. That absence of reporting does not prove that exploitation has not occurred.

The researchers also documented a lab-tested way to disable the chase fallback when immediate patching is not possible, although it can break legitimate enrollment flows.

The bug sits in an AD CS enrollment fallback known as a chase. When a certification authority (CA) cannot obtain an end entity’s information, the Windows enrollment protocol lets a request provide cdc, the Active Directory server to contact, and rmd, the machine object to resolve.

The researchers found that the CA followed the requester-supplied cdc host over Server Message Block (SMB) and Lightweight Directory Access Protocol (LDAP) without first proving it was a real Domain Controller.

An attacker could run rogue Local Security Authority (LSA) and LDAP services, relay the CA’s authentication challenge to the real Domain Controller over Netlogon, and return the target Domain Controller’s objectSid and dNSHostName. A controlled machine account supplied the valid domain identity needed for the CA to continue. The CA authenticated that account, then signed the target Domain Controller’s identity into the certificate.

The public exploit automates the chain. It creates a computer account or reuses one specified with --computer-name. The tool starts listeners on ports 445 and 389 and relays the CA’s challenge to the real Domain Controller over Netlogon. It then submits the cdc and rmd attributes and writes a PFX file and Kerberos credential cache.

The exploit uses Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate as the target Domain Controller. The resulting credential can request account secrets through DCSync, including krbtgt.

The researchers’ binary analysis found that Microsoft’s July update adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll before the CA follows a chase. The validation rejects IP literals, overlong names, and LDAP metacharacters. It also requires exactly one matching Active Directory computer object whose DNS name matches the target and whose userAccountControl includes SERVER_TRUST_ACCOUNT (8192). A later SID comparison blocks object substitution.