Certighost Exploit Enables Domain Controller Impersonation via Misconfigured AD CS

Security researchers H0j3n and Aniq Fakhrul have released proof-of-concept code for a critical Active Directory attack technique dubbed the Certighost exploit. The technique allows low-privileged domain users to request authentication certificates on behalf of Domain Controllers, escalating privileges to full domain compromise without requiring high-level credentials.

Attack Mechanics and DCSync Execution

The Certighost exploit targets systemic trust misconfigurations within Active Directory Certificate Services (AD CS), specifically public or internal certificate templates that permit requestors to specify Subject Alternative Names (SANs) or misconfigured certificate request enrollment rights (often classified alongside ESC1/ESC2/ESC6 misconfiguration patterns).

When an authenticated user requests a certificate using a vulnerable template, they inject the identity (sAMAccountName or Service Principal Name) of a target Domain Controller into the SAN parameter. If the AD CS authority approves the request without verifying machine account ownership, it signs an X.509 certificate tethered to that Domain Controller account.

With a valid DC certificate in hand, the attacker authenticates via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos) to obtain a Kerberos Ticket Granting Ticket (TGT) under the identity of the Domain Controller. Because Domain Controller accounts inherently belong to the Enterprise Domain Controllers group and possess directory replication rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), the attacker can execute a DCSync attack. This allows them to request password hashes for any domain identity—including the krbtgt account hash—effectively compromising the entire Active Directory forest.

Detection and Remediation Strategies

To defend against the Certighost technique, organizations must audit AD CS template security permissions and enforce strict identity verification on PKI endpoints:

• Disable Direct SAN Definition: Modify certificate templates to clear the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the Enterprise CA and remove the ENROLLEE_SUPPLIES_SUBJECT flag on published templates used for authentication.
• Audit Active Directory Certificate Templates: Run tools such as Certipy or PKIAudit (certipy find -vulnerable) to locate templates allowing non-administrative users to request certificates with arbitrary subject names or client authentication EKU flags.
• Restrict DC Enrollment: Restrict permissions on Domain Controller certificate templates so only legitimate computer accounts within the Domain Controllers organizational unit (OU) have Enroll or AutoEnroll rights.
• Monitor for Unusual DCSync Requests: Configure SIEM detection rules for Event ID 4662 (An operation was performed on an object) where access mask 0x100 is requested for replication extended rights by non-standard computer objects or recently issued client certificates.