CVE-2026-54121 - AD CS "Certighost" Elevation of Privilege Framework-Toolkit

Active Directory Certificate Services — Certighost → Domain Takeover

Exploit Framework & Audit Toolkit
For authorized security testing only.

⚖️ Legal Disclaimer & Responsible Use

This tool is provided for educational and authorized penetration testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by this software. Users are solely responsible for ensuring they have explicit written permission from the target owner before testing. Unauthorized access to computer systems is illegal under applicable federal, state, and international cybercrime laws. By using this software, you agree to:

• Use it only on systems you own or have explicit permission to test.
• Comply with all applicable local, state, and federal laws.
• Not use it for any malicious, destructive, or illegal activities.

⚠️ WARNING: Active Directory elevation of privilege vulnerabilities present high risk to enterprise infrastructure. Unauthorized testing is strictly prohibited.

[+!] Vulnerability Overview

CVE-2026-54121 (Dubbed "Certighost") is an Elevation of Privilege (EoP) vulnerability in Microsoft Active Directory Certificate Services (AD CS). It allows low-privileged domain users to impersonate Domain Controller machine accounts and achieve full Domain Admin takeover via certificate forgery.

How it works:

1. Target Validation Bypass: The vulnerability exists due to improper authorization checks (CWE-285) in AD CS during the handling of certificate request target parameters.
2. Rogue Server Redirection: The Certificate Authority (CA) accepts client-supplied server redirection targets without verifying whether the target is an authorized Domain Controller.
3. Domain Controller Impersonation: The CA queries the attacker-controlled server and issues a valid computer certificate signed under the identity of a privileged Domain Controller.
4. Domain Takeover (DCSync): Using the forged DC certificate, the attacker authenticates via Kerberos/PKINIT to gain Domain Controller privileges and execute DCSync operations.

Key Facts:

Warning! 🌬️

This code has been written with a user-friendly approach in mind and is fully functional, prioritizing security, privacy, and minimal logging. It is recommended that you completely remove the Shodan integration and library, use a single thread instead of a thread pool, remove port scanning and detect_ip, and disable logging and output. Use “stealthcert.py” for this version.

CVE-2026-54121 CertiGhost - Parameter Reference

📋 Complete Parameter List

Python Exploit Parameters

stealthcare.py (Safe Exp)

PowerShell Wrapper Parameters

🚀 Usage Examples

git clone https://tc4dy/CVE-2026-54121-PoC-Exploit
#install requirements

Exapmles ❄️

# Auto-discovers CA via LDAP, creates temp computer, spawns rogue servers, requests certificate with cdc redirect, extracts DC's NT hash via PKINIT, enables DCSync for domain takeover
python3 certighost.py -d playground.local -u lowpriv -p Password123 --dc-ip 192.168.1.10

# Impersonates a specific Domain Controller (DC01$). Useful when you know exactly which DC to target. Bypasses auto-discovery
python3 certighost.py -d corp.local -u user -p Passw0rd --dc-ip 10.0.0.1 --target-san DC01$

# Uses NTLM hash instead of password. Works when password is unknown but hash is obtained. ':' before hash = empty LM hash
python3 certighost.py -d domain.local -u admin --hashes :8846f7eaee8fb117ad06bdd830b7586c --dc-ip 192.168.1.10

# Bypasses LDAP CA discovery. Uses explicitly provided CA IP and name. Useful when LDAP is restricted or CA is on different subnet
python3 certighost.py -d playground.local -u lowpriv -p Password123 --dc-ip 192.168.1.10 --ca-ip 192.168.1.20 --ca "PLAYGROUND-CA"

Powershell (Detect)

# Native LDAP query to check if AD CS is present. Returns CA name and DNS. Read-only, safe for production. No exploitation performed
.\CertiGhost.ps1 -d playground.local --dc-ip 192.168.1.10 --username lowpriv -p Password123 --detect

Python Backend Exp

# Runs native AD CS detection then calls Python certighost.py with all parameters. Requires certighost.py in same directory. Prints NT hash and ccache file
.\CertiGhost.ps1 -d corp.local --dc-ip 10.0.0.1 --username attacker -p P@ssw0rd --exploit --target-account DC01$

Save JSON, Detect Mode

#Detection only mode. Saves results in JSON format. Useful for automation, reporting, and integration with other security tools
.\CertiGhost.ps1 -d domain.local --dc-ip 192.168.1.10 --username user -p pass --detect -o results.json

🧠 Technical Deep Dive

1. AD CS Target Validation Bypass (Certighost)

The vulnerability stems from improper authorization and validation checks (CWE-285) within Active Directory Certificate Services (AD CS) during certificate enrollment processes. An attacker with low-privileged domain credentials can manipulate target redirection parameters to trick the Certificate Authority (CA) into verifying identity assertions against a rogue endpoints.

Vulnerable Endpoint / Request Context:

POST /certsrv/mscep/mscep.dll HTTP/1.1
Host: ca-server.domain.local
Content-Type: application/x-www-form-urlencoded

... (Certificate Request payload with manipulated target/cdc parameters)

2. Attack Vectors

• Chase Target Manipulation: An attacker modifies the target redirection parameters (such as cdc / chase target) within the certificate request, forcing the Certificate Authority (CA) to route verification traffic to a specified endpoint.

• Rogue Server Redirection: The Certificate Authority (CA) initiates LDAP or SMB connections to the client-supplied destination without validating whether the target is a legitimate and authorized Domain Controller.

• DC Identity Forgery & Certificate Issuance: The rogue server under the attacker's control responds to verification queries issued by the CA on behalf of the targeted Domain Controller account. Relying on this response, the CA issues a valid, signed certificate carrying the identity of the Domain Controller.

3. Post‑Exploitation

Ticket Granting Ticket (TGT) Retrieval

Using the obtained Domain Controller certificate, Kerberos authentication is performed via PKINIT (Public Key Cryptography for Initial Authentication) to retrieve a high-privileged TGT.

DCSync Attack

With a Kerberos ticket possessing Domain Controller privileges, password hashes for all accounts in the Active Directory database (e.g., krbtgt, Administrator) are extracted using the DCSync technique.

Persistence

• Golden Ticket Creation: TGTs are forged on demand using the extracted krbtgt account password hash.
• Shadow Credentials: Unauthorized certificate keys are appended to the msDS-KeyCredentialLink attribute of targeted accounts to secure persistent access.
• Certificate Template Manipulation: AD CS template permissions are altered to maintain backdoor configurations that allow future privilege escalation.

Lateral Movement

• Domain Dominance: Fully privileged (SYSTEM / Domain Admin) sessions are established across all servers and workstations within the domain.
• Cross-Forest Pivoting: Traversal into trusting domains (Forest Trust) is achieved using SID History or TGT Delegation techniques.

📚 References

• NVD - CVE-2026-54121
• Microsoft Security Update Guide - CVE-2026-54121
• CERT/CC Vulnerability Note
• MITRE ATT&CK - T1649: Steal or Forge Authentication Certificates

🔗 Other Exploits

• CVE-2026-15409/15410 - SonicWall SMA1000 Multi-Exploit Framework
• CVE-2026-6875 - ServiceNow Pre-Auth RCE Exploit Framework
• CVE-2026-41091 - SolarFlare (RedSun) Microsoft Defender LPE
• CVE-2026-57821 - Apache Fineract SQL Injection Toolkit
• CVE-2026-41940 - cPanel/WHM Authentication Bypass