Certighost PoC Released: AD CS Vulnerability Allows Full Windows Domain Hijack

A public proof-of-concept exploit script dubbed certighost.py has been released for “Certighost”, a critical Active Directory Certificate Services vulnerability tracked as CVE-2026-54121. The vulnerability allows an authenticated, low-privileged domain user to impersonate a Domain Controller (DC) and achieve full Active Directory domain compromise. Discovered and reported to Microsoft on May 14, 2026, by security researchers H0j3n and Aniq Fakhrul, the flaw was patched as part of Microsoft’s July 2026 Patch Tuesday release before full technical writeups and exploit code were published.

Active Directory Certificate Services (AD CS) acts as the public key infrastructure (PKI) foundation for Windows environments, issuing digital certificates used for encrypted communications, smart card sign-ons, and Kerberos PKINIT authentication. Because certificate-based identities bypass traditional password checks, AD CS configuration flaws and implementation bugs have become primary targets for domain escalation and persistence.

Mechanics of the Certighost AD CS Flaw

The Certighost attack vector exploits a logic flaw inside AD CS during certificate enrollment when handling an optional fallback mechanism referred to as a “chase.” When a client submits a certificate enrollment request, it can pass two specific request parameters:

• Client DC (cdc): Identifies the specific server that the Certification Authority (CA) should contact to pull directory attributes.
• Remote Domain (rmd): Specifies the target directory account the CA should search for.

When both values are provided in an enrollment request, the CA initiates a connection to the server specified in cdc and queries it for information regarding the account listed in rmd. Prior to Microsoft’s July patch, AD CS failed to validate whether the server supplied in the client-controlled cdc attribute was a legitimate Domain Controller registered within Active Directory.

This missing validation allows an attacker to set up a rogue server hosting fake SMB, LSA, and LDAP services, supply the IP address or hostname of that rogue system in the cdc parameter, and direct the CA to retrieve false directory attributes for a targeted machine account.

To satisfy initial authentication checks when communicating with the CA, the attacker relies on the default Active Directory configuration attribute ms-DS-MachineAccountQuota. Under default domain settings, any standard domain user is permitted to join up to 10 machine accounts to the domain. By creating a valid machine account, the attacker establishes a legitimate domain principal that satisfies the CA’s baseline identity checks, allowing the rogue endpoint to negotiate the chase request even though it is spoofing a Domain Controller.

How the PoC Exploit Achieves Full Domain Takeover

The newly published certighost.py exploit automates the multi-stage attack path required to pivot from a low-privileged user account to total domain control:

1. Machine Account Creation: The exploit uses standard domain credentials to register a new machine account via the default ms-DS-MachineAccountQuota allowance.
2. Rogue Service Redirection: The script launches localized rogue LDAP, LSA, and SMB services, then submits an AD CS certificate enrollment request with the cdc parameter pointed at the attacker’s server and the rmd parameter set to the computer account of a targeted Domain Controller.
3. Certificate Forgery & Retrieval: Because the CA trusts the spoofed directory attributes returned by the attacker’s rogue services, it issues a valid machine certificate bound to the targeted Domain Controller’s identity.
4. PKINIT Authentication: The certighost.py tool uses the newly issued certificate to authenticate against Kerberos via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). The script captures the resulting Kerberos ticket-granting ticket (TGT), saves it to a .ccache credential file, and extracts the target Domain Controller’s NT hash.
5. DCSync & Secrets Dumping: Because Domain Controller accounts possess inherent directory replication privileges (DS-Replication-Get-Changes-All), the attacker uses the captured Kerberos TGT alongside tools like Impacket’s secretsdump to perform a DCSync attack. This allows the attacker to request all domain account secrets over the Directory Replication Service Remote Protocol (MS-DRSR), including the critical krbtgt account hash.

Blast Radius and Active Directory Risk

The blast radius for Certighost spans virtually any enterprise environment running Active Directory Certificate Services where default domain configurations remain untouched. Because the initial requirement is merely a standard domain user account, any compromised workstation, phishing entry point, or insider threat can instantly trigger full domain takeover.

Compromise of the krbtgt account hash represents the ultimate breach of an Active Directory administrative boundary. With this secret, attackers can forge Golden Tickets—arbitrary Kerberos ticket-granting tickets valid for any account in the forest—granting permanent, undetectable persistence that survives domain controller reboots and password resets until the krbtgt key is explicitly rotated twice.

Patching and Remediation

Organizations running AD CS must immediately prioritize applying Microsoft’s July 2026 security updates. The official vendor patch updates the enrollment validation logic so that the CA explicitly verifies that any server supplied in the cdc attribute maps to a known, legitimate Domain Controller registered within Active Directory, while enforcing strict attribute matching on the returned identity.

If immediate patching across all Domain Controllers and Certification Authorities is not viable, security teams should implement the following mitigations:

• Disable Optional Chase Fallback: Administrators can manually disable the AD CS chase fallback mechanism. However, researchers emphasize that this is an unverified workaround that should be carefully tested in staging prior to production deployment to avoid breaking specialized certificate issuance workflows.
• Harden Machine Account Quota: Modify the ms-DS-MachineAccountQuota attribute on the Active Directory domain head, reducing its value from the default of 10 down to 0. This prevents standard users from registering new machine accounts, disrupting the prerequisite step required by the current Certighost exploit chain.
• Monitor for Exploit Indicators: Security Operations Centers (SOC) should alert on anomalous PKINIT certificate requests for Domain Controller computer accounts originating from non-DC IP addresses, as well as unexpected directory replication calls (DCSync) originating from host systems outside the established DC IP subnet.