{"id":1998,"date":"2026-07-24T15:31:03","date_gmt":"2026-07-24T15:31:03","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1998"},"modified":"2026-07-24T15:31:03","modified_gmt":"2026-07-24T15:31:03","slug":"certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1998","title":{"rendered":"Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Jul 24, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.<\/p>\n

They codenamed the flaw Certighost<\/strong>. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt<\/code> secret through DCSync<\/code>.<\/p>\n

Microsoft patched the Active Directory Certificate Services (AD CS) issue ten days earlier as CVE-2026-54121<\/code><\/strong>. Microsoft classed the flaw as improper authorization and assigned it a CVSS score of 8.8.<\/p>\n

Exploitation requires network access and a domain account, but no administrator rights or user interaction. In the researchers’ test, a normal Domain Users<\/code> account could create a computer account under the default ms-DS-MachineAccountQuota<\/code> value of 10<\/code> or reuse one it already controlled.<\/p>\n

The chain also required an Enterprise CA that followed the vulnerable chain path, enrollment through the default Machine template, and network reachability from the CA to the attacker’s SMB and LDAP listeners.<\/p>\n

Organizations running an Enterprise CA should install Microsoft’s July 14 updates on AD CS hosts. As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild, but the full proof-of-concept was public. That absence of reporting does not prove that exploitation has not occurred.<\/p>\n

The researchers also documented a lab-tested way to disable the chase fallback when immediate patching is not possible, although it can break legitimate enrollment flows.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The bug sits in an AD CS enrollment fallback known as a chase. When a certification authority (CA) cannot obtain an end entity’s information, the Windows enrollment protocol<\/a> lets a request provide cdc<\/code>, the Active Directory server to contact, and rmd<\/code>, the machine object to resolve.<\/p>\n

<\/p>\n

The researchers found<\/a> that the CA followed the requester-supplied cdc<\/code> host over Server Message Block (SMB) and Lightweight Directory Access Protocol (LDAP) without first proving it was a real Domain Controller.<\/p>\n

An attacker could run rogue Local Security Authority (LSA) and LDAP services, relay the CA’s authentication challenge to the real Domain Controller over Netlogon<\/code>, and return the target Domain Controller’s objectSid<\/code> and dNSHostName<\/code>. A controlled machine account supplied the valid domain identity needed for the CA to continue. The CA authenticated that account, then signed the target Domain Controller’s identity into the certificate.<\/p>\n

\"\"<\/a><\/div>\n

The public exploit<\/a> automates the chain. It creates a computer account or reuses one specified with --computer-name<\/code>. The tool starts listeners on ports 445<\/code> and 389<\/code> and relays the CA’s challenge to the real Domain Controller over Netlogon<\/code>. It then submits the cdc<\/code> and rmd<\/code> attributes and writes a PFX<\/code> file and Kerberos credential cache.<\/p>\n

The exploit uses Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate as the target Domain Controller. The resulting credential can request account secrets through DCSync<\/code>, including krbtgt<\/code>.<\/p>\n

The researchers’ binary analysis found that Microsoft’s July update<\/a> adds CRequestInstance::_ValidateChaseTargetIsDC<\/code> to certpdef.dll<\/code> before the CA follows a chase. The validation rejects IP literals, overlong names, and LDAP metacharacters. It also requires exactly one matching Active Directory computer object whose DNS name matches the target and whose userAccountControl<\/code> includes SERVER_TRUST_ACCOUNT<\/code> (8192<\/code>). A later SID<\/code> comparison blocks object substitution.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The public exploit was tested in a Windows Server 2016-or-later forest with an Enterprise CA, the default Machine certificate template, and the default machine-account quota. The NVD record<\/a> separately lists Windows Server 2012 through Windows Server 2025, including listed Server Core editions, as affected. It also lists Windows 10 versions 1607 and 1809. The flaw was absent from CISA’s Known Exploited Vulnerabilities catalog<\/a> on July 24.<\/p>\n

The researchers reported the flaw to Microsoft on May 14. Microsoft confirmed it on May 22 and patched it on July 14. The researchers publicly disclosed it on July 24. Administrators who cannot patch immediately can clear the chase flag and restart Certificate Services:<\/p>\n

certutil -setreg policy\\EditFlags -EDITF_ENABLECHASECLIENTDC<\/code><\/p>\n

Restart-Service CertSvc -Force<\/code><\/p>\n

The researchers tested that mitigation only in a controlled lab. They recommend staging it first and treating the July update as the permanent fix.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Swati Khandelwal\ue802Jul 24, 2026Vulnerability \/ Enterprise Security Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for…<\/p>\n","protected":false},"author":1,"featured_media":1999,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,2709,1679,1814,83,120,2711,332,2710,826],"class_list":["post-1998","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-certighost","tag-controller","tag-directory","tag-domain","tag-exploit","tag-impersonate","tag-lets","tag-lowprivileged","tag-users"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1998"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1998\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1999"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}