Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS

1. Basic Information

• Article Title: New Certighost PoC exploit lets attackers hijack Windows domains
• Source: BleepingComputer
• Published Date: 2026-07-27
• Original Article: https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/
• Primary Source: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
• Related Entities: CVE-2026-54121, Certighost, Microsoft AD CS, Enterprise CA, PKINIT, Kerberos, DCSync, Impacket
• Severity: High

2. One-Sentence Summary

A public PoC allows a low-privilege domain user to point AD CS "chase" references to an attacker host, trick the CA into trusting fake LDAP/LSA responses to get a Domain Controller certificate, and then take over the entire domain using PKINIT and DCSync.

3. Attack Flow

• An attacker connects to LDAP with a low-privilege domain account and lists CAs, DCs, and Domain SIDs/GUIDs.
• The attacker uses the default ms-DS-MachineAccountQuota=10 setting to create a computer account and register an SPN.
• The attacker starts fake LDAP and LSA services on their host.
• The attacker specifies their host in the certificate request's cdc (Client DC) field and the target DC in the rmd (Remote Domain) field.
• The CA connects to the attacker-specified cdc via SMB/LDAP to chase the reference.
• The attacker's service relays the CA's authentication challenge to the real DC and returns the target DC's objectSid and dNSHostName.
• The vulnerable CA treats the returned data as authoritative and issues a certificate containing the target DC's SID and DNS name.
• The attacker uses PKINIT to get a Kerberos TGT as the DC and saves it to a .ccache file.
• The attacker performs a DCSync using the DC account's replication rights to steal secrets, including krbtgt.

4. Attacker Position and Execution Location

• The attacker needs a host inside the domain with valid authentication that can reach the CA, DC, and SMB/LDAP ports.
• The fake LDAP/LSA runs on the attacker's host, certificate processing runs on the Enterprise CA, and PKINIT/DCSync run on the DC.
• No emails or user interaction are required.

5. What Victims and Administrators See

• New computer accounts and SPNs.
• Unusual SMB/LDAP connections from the CA to unexpected hosts.
• Certificate requests containing cdc and rmd attributes.
• Issuance of a certificate containing a DC SID and DNS name, followed immediately by PKINIT.
• Kerberos authentication and replication requests for a DC account originating from a non-DC host.

6. Success and Failure Conditions

Success Conditions

• An unpatched AD CS and an Enterprise CA configuration that allows chase processing.
• A valid low-privilege domain account.
• Settings that allow creating machine accounts, or an existing controllable principal.
• SMB/LDAP network connectivity from the CA to the attacker host.
• Network paths for certificate enrollment, Kerberos, and replication from the attacker to the CA/DC.

Failure Conditions

• The July 2026 update is applied, causing the CA to verify cdc as a real DC and check that the SIDs match.
• Machine creation is restricted (e.g., ms-DS-MachineAccountQuota=0).
• CA egress traffic is strictly limited to legitimate DCs.
• Suspicious certificate requests, issuances, PKINIT, and DCSync activities are blocked.

7. What Happens Upon Success

The attacker uses the CA-signed certificate to impersonate a DC, obtains Kerberos credentials, and gains directory replication rights. Stealing hashes like krbtgt should be treated as a total domain compromise. A simple password change may not fix issued certificates, tickets, or persistence.

8. Observable Logs

• Email: None.
• Proxy/SWG/DNS: Name resolution of the attacker's host name by the CA.
• Endpoint/EDR: Python/Impacket scripts, listening LDAP/LSA ports, .ccache files, and secretsdump on the attacker host.
• Identity/IdP: New computer objects, SPNs, certificate enrollment, PKINIT, DC account TGTs, and DCSync.
• SaaS/Cloud: None directly. Check for downstream impact if the synchronized identity provider trusts the AD.
• Network: SMB/LDAP traffic from CA to attacker, traffic from attacker to CA/DC, and DRSUAPI traffic from non-DC hosts.

9. Attack Success Determination

• Prerequisites: Low-privilege authentication, new machine and SPN
• Abuse Attempt: cdc/rmd requests, SMB/LDAP from CA to a non-DC
• Certificate Success: Issuance of a certificate with DC SID/DNS
• Authentication Success: PKINIT/TGT for the DC account from the attacker's terminal
• Domain Compromise: DCSync and theft of krbtgt or other secrets
• Subsequent Compromise: Golden Ticket, privilege creation, lateral movement, cloud sync abuse

Do not assume a domain compromise based solely on PoC execution or requests. Judge the success in stages: certificate issuance, PKINIT, and DCSync.

10. Investigation Playbook

• Trigger: SMB/LDAP traffic from CA to a non-DC, unusual certificate requests immediately following a new machine creation, or DCSync originating from a non-DC.
• Initial Check: Check CA updates, feature flags, request/issuance databases, cdc/rmd fields, requestors, and target SIDs.
• Endpoints: Preserve evidence of PoC files, Impacket, Python, listening ports, .ccache, and secretsdump.
• Authentication & Cloud: Check computer objects/SPNs, PKINIT, Event IDs 4768/4769, DC replication, and Entra sync accounts.
• Subsequent Actions: Check for changes to krbtgt, Domain Admins, GPOs, certificates, tickets, and sync infrastructure.
• Containment: Apply CA updates, restrict CA egress, isolate the attacker host, revoke certificates, and plan a rotation for affected accounts, keys, and krbtgt.
• Classification: Recon / Chase Attempt / DC Certificate Issued / DC Authentication / DCSync / Domain Compromise.

11. Defense and Detection Ideas

• Single Events: CA connecting to a non-DC via LDAP/SMB, creation of a new machine, use of cdc/rmd, or DCSync from a non-DC.
• Timeline Correlation: Machine creation → SPN creation → CA enrollment → CA reverse connection → DC certificate → PKINIT → DCSync.
• Hunting: Mismatch between the requestor/source of a DC certificate and the target DC, or CA communication destinations outside the DC allowlist.
• Log Gaps: Centrally store CA audit and issuance databases, Kerberos certificate mappings, and DRSUAPI logs.
• Prioritized Mitigations: Apply the July update, restrict MachineAccountQuota, limit CA egress, and monitor certificate-based authentication.

12. Facts / Inference / Hypothesis

Facts - The public PoC automates everything from low-privilege user access to DC certificate acquisition, PKINIT, and DCSync. After patching, the CA verifies that cdc is a SERVER_TRUST_ACCOUNT in AD and checks for matching SIDs. No active exploits have been confirmed at the time of publication.

Inference - If there is evidence of success, the scope of the compromise must be expanded from just the CA to the entire domain.

Hypothesis - Correlating CA SMB/LDAP traffic toward non-DCs with the creation of a new machine just beforehand provides early detection with few false positives.

13. MITRE ATT&CK Mapping

• T1136.002 - Create Account: Domain Account (High)
• T1553.004 - Subvert Trust Controls: Install Root Certificate (Low. Involves certificate abuse, but strictly speaking, it is fraudulent issuance.)
• T1649 - Steal or Forge Authentication Certificates (High)
• T1558 - Steal or Forge Kerberos Tickets (High)
• T1003.006 - OS Credential Dumping: DCSync (High)
• T1069.002 - Permission Groups Discovery: Domain Groups (Medium)
• T1018 - Remote System Discovery (Medium)

14. Unknowns and Additional Investigation

• All combinations of vulnerable Windows Server versions and templates, and whether protection features are enabled by default.
• cdc/rmd audit fields in real environments and methods to search for previously issued certificates.
• Active exploitation, PoC variants, and EDR detection status.

15. Impact on SOCs and Enterprise Environments

AD CS is often operated long-term with minimal monitoring. Organizations should treat CA servers as Tier 0 assets rather than standard Windows servers. They need to monitor updates, issuance audits, egress traffic, machine account creation, PKINIT, and DCSync across the board.

16. Summary by Target Audience

• For SOCs: Correlate CA-to-non-DC traffic with new machine creation, certificate requests, PKINIT, and DCSync.
• For Administrators: Apply the July update to the CA, minimize MachineAccountQuota, and restrict CA egress traffic.
• For Users: No user action is required. Because even a low-privilege account compromise can lead to a Tier 0 incident, report any authentication anomalies immediately.