🛡 AI Security Tool Module
CVE-2026-54121: Active Directory Certificate Services Impersonation (Certighost)

Official Security Audit Module for AI Security Tool Ecosystem

🌐 Web Demo • 📚 Project Website • 💬 Community Chat

Website Navigation: Home • Updates • Downloads • Modules

🧠 Conceptual Overview

This module provides diagnostic capabilities for CVE-2026-54121, dubbed Certighost. The vulnerability exists within Active Directory Certificate Services (AD CS) during the validation phase of computer account certificate enrollments.

An attacker possessing standard low-privileged domain credentials creates a new computer account and submits a certificate request containing manipulated cdc (controlled IP listener) and rmd (target DC FQDN) attributes. When the Certificate Authority (CA) connects back to validate the machine's identity, rogue LDAP (port 389) and SMB/LSA (port 445) listeners spoof the target Domain Controller's identity attributes (sAMAccountName, SID, dNSHostName). This tricks the CA into issuing an authentic Domain Controller certificate, allowing full domain compromise via PKINIT.

🎯 Core Impact Philosophy

"Authenticate as a machine, escalate to the entire domain."
Certighost bypasses traditional AD CS template permissions by poisoning the CA's identity resolution pipeline. Obtaining a valid Domain Controller certificate grants instant PKINIT authentication, yielding both a TGT credential cache (.ccache) and the target DC's NT hash.

📊 Vulnerability Specifications

🕸 Attack Scenario & Architecture

graph TD
    A[Low-Priv Domain User] -->|1. Create Computer Account| B[Domain Controller]
    A -->|2. Start Rogue SMB 445 / LDAP 389 Listeners| C[Attacker Machine]
    A -->|3. Submit Cert Request with cdc & rmd Attributes| D[Active Directory CA]
    D -->|4. CA Lookups Connect to Rogue Listeners| C
    C -->|5. Validate via Netlogon & Return Target DC Identity| D
    D -->|6. Issue Valid DC Certificate .pfx| A
    A -->|7. Perform PKINIT with DC Certificate| E[Full Domain Takeover / NT Hash Export]

🛡 Mitigation Checklist

• 🟢 Apply Security Updates: Deploy official Microsoft patches addressing CVE-2026-54121 across AD CS servers.
• 🟢 Restrict Machine Account Creation: Set ms-DS-MachineAccountQuota to 0 to prevent non-admin users from creating new computer objects.
• 🟡 AD CS Hardening: Disable vulnerable certificate templates and ensure EDITF_ATTRIBUTESUBJECTALTNAME2 (ESC6) is turned off unless explicitly required.
• 🟡 Network Filtering: Block outbound SMB (445) and LDAP (389) traffic from CA servers to arbitrary workstations.

💻 How to Run this Module

⚠️ IMPORTANT: This module is designed for safe diagnostic testing within the AI Security Tool framework. Execute only against authorized targets with elevated administrative privileges.

1️⃣ Install AI Security Tool

To execute the diagnostic and monitoring scripts, install the core AI Security Tool framework:

2️⃣ Install Dependencies & Execution

Install the required Python libraries for rogue LDAP/SMB listeners and certificate handling:

# Install python dependencies
sudo pip install --break-system-packages git+https://github.com/fortra/impacket.git cryptography pyasn1 asn1crypto pycryptodome dnspython

# Execute Certighost proof-of-concept (Requires root for ports 389/445)
sudo python3 certighost.py -d playground.local -u lowpriv -p 'Password1234' --dc-ip 192.168.1.10

🔍 Security Audit Modules & PoC Repositories

Vulnerability scanner modules, PoC scripts, and research repos maintained by our community:

⚖️ License & Legal Disclaimer

🚨 Disclaimer

This tool and security analysis are provided strictly for authorized system auditing, defensive research, and penetration testing engagements.
Executing CVE-2026-54121 against domain environments without express written permission from the system owner is illegal. The authors assume no responsibility for unauthorized domain compromise, data loss, or system disruptions.

🔄 Contribution & Community

We welcome contributions from the security research community! Primary contribution areas:

1. AI Integrations: Adding new LLM providers and developing specialized security agents.
2. Security Tools: Developing vulnerability modules and integrating CLI scanners.
3. Optimization: Enhancing parser speed, execution safety, and caching logic.
4. Documentation: Writing research papers, guides, and localized translations.

🔗 Contact & Support

• Official Website: ZeroDayEvil.com
• Technical Analysis: Gist Breakdown by H0j3n
• MSRC Advisory: CVE-2026-54121 Guide
• Telegram Admin: @ZeroDayEvil
• Telegram Chat: @ZeroDyaTool_chat
• Telegram Channel: @ZeroDyaTool_channel
• Sponsor Project: PayPal Donations
• Open Collective: opencollective.com/ZeroDayEvil

AI Security Tool — Reimagining terminal workflow and automation for cybersecurity professionals.