🛡 AI Security Tool Module
CVE-2026-54121: Active Directory Certificate Services Impersonation (Certighost)

Official Security Audit Module for AI Security Tool Ecosystem

---

🌐 Web Demo • 📚 Project Website • 💬 Community Chat

Website Navigation: Home • Updates • Downloads • Modules

---

🧠 Conceptual Overview

This module provides diagnostic capabilities for CVE-2026-54121, dubbed Certighost. The vulnerability exists within Active Directory Certificate Services (AD CS) during the validation phase of computer account certificate enrollments.

An attacker possessing standard low-privileged domain credentials creates a new computer account and submits a certificate request containing manipulated cdc (controlled IP listener) and rmd (target DC FQDN) attributes. When the Certificate Authority (CA) connects back to validate the machine's identity, rogue LDAP (port 389) and SMB/LSA (port 445) listeners spoof the target Domain Controller's identity attributes (sAMAccountName, SID, dNSHostName). This tricks the CA into issuing an authentic Domain Controller certificate, allowing full domain compromise via PKINIT.

🎯 Core Impact Philosophy

"Authenticate as a machine, escalate to the entire domain."
Certighost bypasses traditional AD CS template permissions by poisoning the CA's identity resolution pipeline. Obtaining a valid Domain Controller certificate grants instant PKINIT authentication, yielding both a TGT credential cache (.ccache) and the target DC's NT hash.

📊 Vulnerability Specifications

Specification	Assigned Value	Notes
CVE Identifier	CVE-2026-54121	Active Directory Certificate Services Impersonation
Severity Rating	Critical (CVSS v3.1: 9.8)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type	CWE-287 / CWE-290	Improper Authentication / Authentication Bypass via Spoofing
Affected Component	Active Directory Certificate Services (AD CS)	Certificate Enrollment & Identity Validation Pipeline
Attack Vector	Network	Executed remotely over SMB, LDAP, and RPC protocols
Privileges Required	Low Privileges	Standard domain user account (ability to add machine accounts)

🕸 Attack Scenario & Architecture

graph TD
    A[Low-Priv Domain User] -->|1. Create Computer Account| B[Domain Controller]
    A -->|2. Start Rogue SMB 445 / LDAP 389 Listeners| C[Attacker Machine]
    A -->|3. Submit Cert Request with cdc & rmd Attributes| D[Active Directory CA]
    D -->|4. CA Lookups Connect to Rogue Listeners| C
    C -->|5. Validate via Netlogon & Return Target DC Identity| D
    D -->|6. Issue Valid DC Certificate .pfx| A
    A -->|7. Perform PKINIT with DC Certificate| E[Full Domain Takeover / NT Hash Export]
  

🛡 Mitigation Checklist

• 🟢 Apply Security Updates: Deploy official Microsoft patches addressing CVE-2026-54121 across AD CS servers.
• 🟢 Restrict Machine Account Creation: Set ms-DS-MachineAccountQuota to 0 to prevent non-admin users from creating new computer objects.
• 🟡 AD CS Hardening: Disable vulnerable certificate templates and ensure EDITF_ATTRIBUTESUBJECTALTNAME2 (ESC6) is turned off unless explicitly required.
• 🟡 Network Filtering: Block outbound SMB (445) and LDAP (389) traffic from CA servers to arbitrary workstations.

---

💻 How to Run this Module

⚠️ IMPORTANT: This module is designed for safe diagnostic testing within the AI Security Tool framework. Execute only against authorized targets with elevated administrative privileges.

1️⃣ Install AI Security Tool

To execute the diagnostic and monitoring scripts, install the core AI Security Tool framework: