## https://sploitus.com/exploit?id=5327DD56-6887-5718-A920-F35649219305
# CVE-2026-54121 (Certighost) - patched fork
A working fork of the proof-of-concept tool for CVE-2026-54121, also known as _Certighost_.
Original research and PoC by **[@H0j3n](https://gist.github.com/H0j3n)** and **[@aniqfakhrul](https://github.com/aniqfakhrul/CVE-2026-54121)** detailed analysis at:
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26.
This fork fixes the SAN handling that prevented PKINIT from succeeding on CAs that honor the requested SAN, hardens the `--target-san` parsing, and reworks the computer-account handling so it no longer exhausts the `ms-DS-MachineAccountQuota`.
## Usage
Execute as root because the rogue LDAP and SMB services require the privileged ports 389 and 445.
```bash
sudo python3 certighost.py -d playground.local -u lowpriv -p 'Password1234' --dc-ip 192.168.1.10
```
Upon successful completion, the target certificate (`.pfx`) and Kerberos cache (`.ccache`) are written to the current working directory.
## What this script does
1. Reuse a single stable computer account (`CERTIGHOST$`, created on first run) or use one specified via `--computer-name`.
2. Start two rogue listeners: an SMB/LSA server on port 445 and an LDAP server on port 389.
3. Send a certificate request as that computer account, embedding a custom `cdc` attribute pointing to a controlled IP (via `--listener`; optional, auto-detected if omitted) plus an `rmd` attribute carrying the target DC's DNS name.
4. The CA connects back to the rogue LSA/LDAP listeners. They authenticate as the created account (validated through the real DC over Netlogon) and answer the CA's lookups with the target DC's identity (sAMAccountName, SID, dNSHostName) instead.
5. The CA issues a valid certificate belonging to the DC.
6. The script performs PKINIT with the DC's pfx to request the `.ccache` and NT hash.
## Changes in this fork
### 1. SAN fix (makes PKINIT succeed)
The original built the certificate SAN โ both the CSR `subjectAltName` extension and the `SAN:dns=` request attribute โ from the **rogue computer's** hostname instead of the **target DC's** FQDN. On a CA that honors the requested SAN, the issued certificate therefore carried the rogue account's `dNSHostName`, so PKINIT mapped it to the wrong principal and failed with:
```
KDC_ERR_CLIENT_NAME_MISMATCH(Reserved for PKINIT)
```
The SAN now uses the target DC's `dNSHostName` (`rmd_value` / `target_dns`), which is what PKINIT maps a machine account on. The issued certificate now presents `DNS:.` and the AS-REQ closes as the DC.
### 2. Robust `--target-san`
`--target-san` now accepts any of `MEEREEN`, `MEEREEN$`, or the FQDN `meereen.essos.local` (matched by `sAMAccountName` or `dNSHostName`), instead of only the short `NAME` form.
### 3. Computer-account reuse (no more MAQ exhaustion)
The original created a fresh random `GHOST********$` account on every run. Because computer accounts created via the `ms-DS-MachineAccountQuota` are **owned by Domain Admins** (not the creator), a low-privileged user **cannot delete them**, so repeated runs quickly exhausted the quota (default 10) with orphaned accounts.
This fork reuses a single stable account (`CERTIGHOST$`, created only if it does not already exist), so the quota never grows and there is nothing to clean up between runs.
### 4. Leftover-account warning
When the account is created for the first time, the script prints a warning noting it is left in AD:
```
[!] WARNING: computer account CERTIGHOST$ was created and is left in AD.
```
The account remains for reuse on subsequent runs. To remove it entirely, delete it with a Domain Admin (the object owner):
```powershell
Get-ADComputer CERTIGHOST | Remove-ADComputer -Confirm:$false
```
## Requirements
- Python 3
- `impacket`
- `cryptography`, `pyasn1`, `asn1crypto`, `pycryptodomex`
## References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121
- https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
- https://github.com/aniqfakhrul/CVE-2026-54121 (original PoC)
- https://github.com/ly4k/Certipy
## Disclaimer
For authorized security testing and educational purposes only. Use it only against systems you have explicit permission to test.