DEV Community

Anoymask
Anoymask

Posted on

Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS

#security #threatintel

Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS

1. Basic Information

2. One-Sentence Summary

A public PoC allows a low-privilege domain user to point AD CS "chase" references to an attacker host, trick the CA into trusting fake LDAP/LSA responses to get a Domain Controller certificate, and then take over the entire domain using PKINIT and DCSync.

3. Attack Flow

  1. An attacker connects to LDAP with a low-privilege domain account and lists CAs, DCs, and Domain SIDs/GUIDs.
  2. The attacker uses the default ms-DS-MachineAccountQuota=10 setting to create a computer account and register an SPN.
  3. The attacker starts fake LDAP and LSA services on their host.
  4. The attacker specifies their host in the certificate request's cdc (Client DC) field and the target DC in the rmd (Remote Domain) field.
  5. The CA connects to the attacker-specified cdc via SMB/LDAP to chase the reference.
  6. The attacker's service relays the CA's authentication challenge to the real DC and returns the target DC's objectSid and dNSHostName.
  7. The vulnerable CA treats the returned data as authoritative and issues a certificate containing the target DC's SID and DNS name.
  8. The attacker uses PKINIT to get a Kerberos TGT as the DC and saves it to a .ccache file.
  9. The attacker performs a DCSync using the DC account's replication rights to steal secrets, including krbtgt.

4. Attacker Position and Execution Location

  • The attacker needs a host inside the domain with valid authentication that can reach the CA, DC, and SMB/LDAP ports.
  • The fake LDAP/LSA runs on the attacker's host, certificate processing runs on the Enterprise CA, and PKINIT/DCSync run on the DC.
  • No emails or user interaction are required.

5. What Victims and Administrators See

  • New computer accounts and SPNs.
  • Unusual SMB/LDAP connections from the CA to unexpected hosts.
  • Certificate requests containing cdc and rmd attributes.
  • Issuance of a certificate containing a DC SID and DNS name, followed immediately by PKINIT.
  • Kerberos authentication and replication requests for a DC account originating from a non-DC host.

6. Success and Failure Conditions

Success Conditions

  • An unpatched AD CS and an Enterprise CA configuration that allows chase processing.
  • A valid low-privilege domain account.
  • Settings that allow creating machine accounts, or an existing controllable principal.
  • SMB/LDAP network connectivity from the CA to the attacker host.
  • Network paths for certificate enrollment, Kerberos, and replication from the attacker to the CA/DC.

Failure Conditions

  • The July 2026 update is applied, causing the CA to verify cdc as a real DC and check that the SIDs match.
  • Machine creation is restricted (e.g., ms-DS-MachineAccountQuota=0).
  • CA egress traffic is strictly limited to legitimate DCs.
  • Suspicious certificate requests, issuances, PKINIT, and DCSync activities are blocked.

7. What Happens Upon Success

The attacker uses the CA-signed certificate to impersonate a DC, obtains Kerberos credentials, and gains directory replication rights. Stealing hashes like krbtgt should be treated as a total domain compromise. A simple password change may not fix issued certificates, tickets, or persistence.

8. Observable Logs

  • Email: None.
  • Proxy/SWG/DNS: Name resolution of the attacker's host name by the CA.
  • Endpoint/EDR: Python/Impacket scripts, listening LDAP/LSA ports, .ccache files, and secretsdump on the attacker host.
  • Identity/IdP: New computer objects, SPNs, certificate enrollment, PKINIT, DC account TGTs, and DCSync.
  • SaaS/Cloud: None directly. Check for downstream impact if the synchronized identity provider trusts the AD.
  • Network: SMB/LDAP traffic from CA to attacker, traffic from attacker to CA/DC, and DRSUAPI traffic from non-DC hosts.

9. Attack Success Determination

Stage Evidence
Prerequisites Low-privilege authentication, new machine and SPN
Abuse Attempt cdc/rmd requests, SMB/LDAP from CA to a non-DC
Certificate Success Issuance of a certificate with DC SID/DNS
Authentication Success PKINIT/TGT for the DC account from the attacker's terminal
Domain Compromise DCSync and theft of krbtgt or other secrets
Subsequent Compromise Golden Ticket, privilege creation, lateral movement, cloud sync abuse

Do not assume a domain compromise based solely on PoC execution or requests. Judge the success in stages: certificate issuance, PKINIT, and DCSync.

10. Investigation Playbook

  • Trigger: SMB/LDAP traffic from CA to a non-DC, unusual certificate requests immediately following a new machine creation, or DCSync originating from a non-DC.
  • Initial Check: Check CA updates, feature flags, request/issuance databases, cdc/rmd fields, requestors, and target SIDs.
  • Endpoints: Preserve evidence of PoC files, Impacket, Python, listening ports, .ccache, and secretsdump.
  • Authentication & Cloud: Check computer objects/SPNs, PKINIT, Event IDs 4768/4769, DC replication, and Entra sync accounts.
  • Subsequent Actions: Check for changes to krbtgt, Domain Admins, GPOs, certificates, tickets, and sync infrastructure.
  • Containment: Apply CA updates, restrict CA egress, isolate the attacker host, revoke certificates, and plan a rotation for affected accounts, keys, and krbtgt.
  • Classification: Recon / Chase Attempt / DC Certificate Issued / DC Authentication / DCSync / Domain Compromise.

11. Defense and Detection Ideas

  • Single Events: CA connecting to a non-DC via LDAP/SMB, creation of a new machine, use of cdc/rmd, or DCSync from a non-DC.
  • Timeline Correlation: Machine creation → SPN creation → CA enrollment → CA reverse connection → DC certificate → PKINIT → DCSync.
  • Hunting: Mismatch between the requestor/source of a DC certificate and the target DC, or CA communication destinations outside the DC allowlist.
  • Log Gaps: Centrally store CA audit and issuance databases, Kerberos certificate mappings, and DRSUAPI logs.
  • Prioritized Mitigations: Apply the July update, restrict MachineAccountQuota, limit CA egress, and monitor certificate-based authentication.

12. Facts / Inference / Hypothesis

Facts

  • The public PoC automates everything from low-privilege user access to DC certificate acquisition, PKINIT, and DCSync.
  • After patching, the CA verifies that cdc is a SERVER_TRUST_ACCOUNT in AD and checks for matching SIDs.
  • No active exploits have been confirmed at the time of publication.

Inference

  • If there is evidence of success, the scope of the compromise must be expanded from just the CA to the entire domain.

Hypothesis

  • Correlating CA SMB/LDAP traffic toward non-DCs with the creation of a new machine just beforehand provides early detection with few false positives.

13. MITRE ATT&CK Mapping

  • T1136.002 Create Account: Domain Account (High)
  • T1553.004 Subvert Trust Controls: Install Root Certificate (Low. Involves certificate abuse, but strictly speaking, it is fraudulent issuance.)
  • T1649 Steal or Forge Authentication Certificates (High)
  • T1558 Steal or Forge Kerberos Tickets (High)
  • T1003.006 OS Credential Dumping: DCSync (High)
  • T1069.002 Permission Groups Discovery: Domain Groups (Medium)
  • T1018 Remote System Discovery (Medium)

14. Unknowns and Additional Investigation

  • All combinations of vulnerable Windows Server versions and templates, and whether protection features are enabled by default.
  • cdc/rmd audit fields in real environments and methods to search for previously issued certificates.
  • Active exploitation, PoC variants, and EDR detection status.

15. Impact on SOCs and Enterprise Environments

AD CS is often operated long-term with minimal monitoring. Organizations should treat CA servers as Tier 0 assets rather than standard Windows servers. They need to monitor updates, issuance audits, egress traffic, machine account creation, PKINIT, and DCSync across the board.

16. Summary by Target Audience

  • For SOCs: Correlate CA-to-non-DC traffic with new machine creation, certificate requests, PKINIT, and DCSync.
  • For Administrators: Apply the July update to the CA, minimize MachineAccountQuota, and restrict CA egress traffic.
  • For Users: No user action is required. Because even a low-privilege account compromise can lead to a Tier 0 incident, report any authentication anomalies immediately.

Top comments (0)