Exploit for Improper Authorization in Microsoft

## https://sploitus.com/exploit?id=FA88DD89-9FC5-55BE-A693-9A90AE3BD327
# CertiGhost (CVE-2026-54121) - AD CS Chase Fallback Exploit Toolkit

## Overview

CertiGhost is a critical vulnerability (CVSS 8.8) in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise.

- **CVE:** CVE-2026-54121
- **CVSS:** 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Patched:** July 14, 2026 (Microsoft Security Updates)
- **PoC Released:** July 24, 2026
- **Affected:** Windows Server 2012-2025 with AD CS Enterprise CA

## Vulnerability Details

The AD CS "chase" fallback mechanism allows a requester to supply `cdc` (Client DC) and `rmd` (Remote Domain) attributes in a certificate request. The CA follows the `cdc` target to resolve identity data without validating it's a legitimate Domain Controller.

**Attack Chain:**
1. Low-privileged user creates machine account (via `ms-DS-MachineAccountQuota`)
2. Attacker runs rogue LDAP/LSA services on controlled host
3. Certificate request submitted with `cdc` pointing to attacker host
4. CA contacts attacker host, accepts forged DC identity data
5. CA issues certificate with target DC's identity (SID, DNS name)
6. Attacker uses certificate for PKINIT → Kerberos TGT as DC
7. DCSync → `krbtgt` hash → Golden Ticket → Full domain compromise

## Documentation

| Document | Content |
|----------|---------|
| [USAGE.md](USAGE.md) | Detailed usage guide with step-by-step instructions |
| [DIAGRAM.md](DIAGRAM.md) | Structure diagrams and attack flow visualization |

## Files

| File | Purpose |
|------|---------|
| `certighost_exploit.py` | Full exploit chain implementation |
| `certighost_test.py` | Detection + exploit toolkit with CLI |
| `ad_detect.py` | Quick targeted detection scan |
| `test_exploit.py` | Unit tests for all exploit components (55 tests) |
| `requirements.txt` | Python dependencies |

## Attack Chain Diagram

```
Stage 1        Stage 2        Stage 3        Stage 4        Stage 5        Stage 6
LDAP Disc.  →  Machine Acct → Rogue Svc  →  Cert Request → PKINIT Auth →  DCSync
  │              │              │              │              │              │
  ▼              ▼              ▼              ▼              ▼              ▼
Find DC/CA   SAMR create   LDAP :389     cdc+rmd attr   TGT as DC01$  krbtgt hash
+ SID/DN     DESKTOP-XX$   SMB :445      → CA chases    → KDC accepts  → Golden
             + SPNs        relay         attacker host   cert as DC    Ticket
```

See [DIAGRAM.md](DIAGRAM.md) for full architecture diagrams.

## Quick Start

### Install Dependencies
```bash
pip install -r requirements.txt
```

### Detection Mode (Safe)
```bash
# Unauthenticated scan
python ad_detect.py

# Authenticated scan (recommended)
python ad_detect.py -u DOMAIN\\username -p 'Password123'

# With specific DC
python ad_detect.py -u DOMAIN\\user -p 'pass' --dc-ip 10.x.x.x
```

### Generic Detection
```bash
python certighost_test.py -d example.com --detect
python certighost_test.py -d example.com -u lowpriv_user -p 'Password123' --detect
```

### Exploit Mode (DESTRUCTIVE - Authorized Testing Only)
```bash
python certighost_test.py -d example.com -u lowpriv_user -p 'Password123' \
    --dc-ip 10.0.0.10 --attacker-ip 10.0.0.99 --exploit
```

## Detection Checks Performed

1. **Domain Controller Discovery** - DNS SRV + A record resolution
2. **Enterprise CA Discovery** - LDAP query to PKI Enrollment Services
3. **Machine Account Quota** - `ms-DS-MachineAccountQuota` value
4. **Chase Fallback Status** - `EDITF_ENABLECHASECLIENTDC` flag
5. **Patch Level** - July 2026 update presence
6. **Certificate Templates** - Client auth templates with enrollee-supplied subject

## Prerequisites for Exploitation

- [ ] Enterprise CA with AD CS deployed
- [ ] Low-privileged domain user account
- [ ] `ms-DS-MachineAccountQuota` > 0 (default: 10)
- [ ] Network reachability from CA to attacker host
- [ ] July 2026 security update NOT applied
- [ ] Default Machine certificate template (or similar)

## Remediation

### Immediate (Critical)
```powershell
# Apply July 2026 Security Update on all CA servers

# Temporary mitigation - disable chase fallback
certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC
Restart-Service CertSvc -Force
```

### Short-term
- Set `ms-DS-MachineAccountQuota` to 0
- Review certificate template ACLs
- Remove `ENROLLEE_SUPPLIES_SUBJECT` from templates
- Enable LDAP signing and channel binding

### Detection
- Monitor for certificate requests with `cdc`/`rmd` attributes
- Alert on new machine account creation by non-admin users
- Monitor for DCSync replication events (Event ID 4662)

## Microsoft Defender Detection

Per the Microsoft Threat Protection blog, deploy the following advanced hunting query:

```kusto
// Detect CertiGhost certificate requests with cdc/rmd attributes
let CertSvcEvents = DeviceEvents
| where ActionType == "CertSvcRequestSubmitted"
| extend RequestAttributes = parse_json(AdditionalFields).RequestAttributes
| where RequestAttributes has "cdc" or RequestAttributes has "rmd";
CertSvcEvents
| project Timestamp, DeviceName, InitiatingProcessAccountName, RequestAttributes
```

## References

- [Microsoft Security Response Center - CVE-2026-54121](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121)
- [CertiGhost Technical Writeup (H0j3n)](https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26)
- [Microsoft Defender Detection Blog](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/detecting-cve-2026-54121-certighost-with-microsoft-defender/4542861)
- [Kudelski Security - CertiGhost Analysis](https://kudelskisecurity.com/research/certighost)
- [Dark Reading - CertiGhost Coverage](https://www.darkreading.com/vulnerabilities-threats/certighost-flaw-microsoft-active-directory-certificates)