CertiGhost (CVE-2026-54121) - AD CS Chase Fallback Exploit Toolkit

Overview

CertiGhost is a critical vulnerability (CVSS 8.8) in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise.

• CVE: CVE-2026-54121
• CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Patched: July 14, 2026 (Microsoft Security Updates)
• PoC Released: July 24, 2026
• Affected: Windows Server 2012-2025 with AD CS Enterprise CA

Vulnerability Details

The AD CS "chase" fallback mechanism allows a requester to supply cdc (Client DC) and rmd (Remote Domain) attributes in a certificate request. The CA follows the cdc target to resolve identity data without validating it's a legitimate Domain Controller.

Attack Chain:

1. Low-privileged user creates machine account (via ms-DS-MachineAccountQuota)
2. Attacker runs rogue LDAP/LSA services on controlled host
3. Certificate request submitted with cdc pointing to attacker host
4. CA contacts attacker host, accepts forged DC identity data
5. CA issues certificate with target DC's identity (SID, DNS name)
6. Attacker uses certificate for PKINIT → Kerberos TGT as DC
7. DCSync → krbtgt hash → Golden Ticket → Full domain compromise

Documentation

Files

Attack Chain Diagram

Stage 1        Stage 2        Stage 3        Stage 4        Stage 5        Stage 6
LDAP Disc.  →  Machine Acct → Rogue Svc  →  Cert Request → PKINIT Auth →  DCSync
  │              │              │              │              │              │
  ▼              ▼              ▼              ▼              ▼              ▼
Find DC/CA   SAMR create   LDAP :389     cdc+rmd attr   TGT as DC01$  krbtgt hash
+ SID/DN     DESKTOP-XX$   SMB :445      → CA chases    → KDC accepts  → Golden
             + SPNs        relay         attacker host   cert as DC    Ticket

See DIAGRAM.md for full architecture diagrams.

Quick Start

Install Dependencies

pip install -r requirements.txt

Detection Mode (Safe)

# Unauthenticated scan
python ad_detect.py

# Authenticated scan (recommended)
python ad_detect.py -u DOMAIN\\username -p 'Password123'

# With specific DC
python ad_detect.py -u DOMAIN\\user -p 'pass' --dc-ip 10.x.x.x

Generic Detection

python certighost_test.py -d example.com --detect
python certighost_test.py -d example.com -u lowpriv_user -p 'Password123' --detect

Exploit Mode (DESTRUCTIVE - Authorized Testing Only)

python certighost_test.py -d example.com -u lowpriv_user -p 'Password123' \
    --dc-ip 10.0.0.10 --attacker-ip 10.0.0.99 --exploit

Detection Checks Performed

1. Domain Controller Discovery - DNS SRV + A record resolution
2. Enterprise CA Discovery - LDAP query to PKI Enrollment Services
3. Machine Account Quota - ms-DS-MachineAccountQuota value
4. Chase Fallback Status - EDITF_ENABLECHASECLIENTDC flag
5. Patch Level - July 2026 update presence
6. Certificate Templates - Client auth templates with enrollee-supplied subject

Prerequisites for Exploitation

• Enterprise CA with AD CS deployed
• Low-privileged domain user account
• ms-DS-MachineAccountQuota > 0 (default: 10)
• Network reachability from CA to attacker host
• July 2026 security update NOT applied
• Default Machine certificate template (or similar)

Remediation

Immediate (Critical)

# Apply July 2026 Security Update on all CA servers

# Temporary mitigation - disable chase fallback
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force

Short-term

• Set ms-DS-MachineAccountQuota to 0
• Review certificate template ACLs
• Remove ENROLLEE_SUPPLIES_SUBJECT from templates
• Enable LDAP signing and channel binding

Detection

• Monitor for certificate requests with cdc/rmd attributes
• Alert on new machine account creation by non-admin users
• Monitor for DCSync replication events (Event ID 4662)

Microsoft Defender Detection

Per the Microsoft Threat Protection blog, deploy the following advanced hunting query:

// Detect CertiGhost certificate requests with cdc/rmd attributes
let CertSvcEvents = DeviceEvents
| where ActionType == "CertSvcRequestSubmitted"
| extend RequestAttributes = parse_json(AdditionalFields).RequestAttributes
| where RequestAttributes has "cdc" or RequestAttributes has "rmd";
CertSvcEvents
| project Timestamp, DeviceName, InitiatingProcessAccountName, RequestAttributes

References

• Microsoft Security Response Center - CVE-2026-54121
• CertiGhost Technical Writeup (H0j3n)
• Microsoft Defender Detection Blog
• Kudelski Security - CertiGhost Analysis
• Dark Reading - CertiGhost Coverage