Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Certighost漏洞允许低权限Active Directory用户冒充域控制器

TL;DR

• The Certighost exploit allows low-privileged Active Directory users to impersonate a Domain Controller by abusing an improper authorization flaw in the AD CS enrollment "chase" fallback mechanism.
• By manipulating the cdc and rmd attributes, attackers can trick the Certificate Authority into signing a certificate for a target Domain Controller, enabling full domain compromise via DCSync.
• Microsoft patched the vulnerability as CVE-2026-54121 (CVSS 8.8) on July 14, adding validation to ensure the chase target is a legitimate DC before proceeding with enrollment.
• The public proof-of-concept demonstrates that exploitation requires no admin rights or user interaction, relying instead on default configurations like the MachineAccountQuota and standard Enterprise CA setups.

Why It Matters

This vulnerability highlights a critical intersection between identity management and certificate infrastructure, demonstrating how default configuration settings (like machine account quotas) can be leveraged for severe privilege escalation. For security practitioners, it underscores the importance of auditing Active Directory Certificate Services (AD CS) configurations and understanding the trust relationships between CAs and Domain Controllers. The ease of exploitation without administrative privileges makes this a high-risk threat for any organization maintaining an Enterprise CA environment.

Technical Details

• Vulnerability Mechanism: The flaw resides in the AD CS "chase" fallback, where the CA contacts an Active Directory server specified by the requester (cdc) to resolve machine object information (rmd). The CA failed to verify that the provided cdc was a genuine Domain Controller before accepting its response.
• Exploitation Chain: Attackers create or reuse a computer account (leveraging the default ms-DS-MachineAccountQuota of 10), run rogue LSA/LDAP listeners, and relay the CA's authentication challenge to the real DC over Netlogon. This allows them to inject the target DC's objectSid and dNSHostName into a certificate request.
• Post-Exploitation Impact: The resulting certificate enables PKINIT authentication as the Domain Controller. This grants the attacker the ability to perform DCSync attacks to retrieve the krbtgt hash and other account secrets, effectively compromising the entire domain.
• Mitigation and Patching: Microsoft’s patch adds CRequestInstance::_ValidateChaseTargetIsDC to certpdef.dll, which validates that the chase target matches a specific AD computer object with SERVER_TRUST_ACCOUNT flags and blocks IP literals or metacharacters. An interim mitigation involves disabling the chase flag via certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC.

Industry Insight

Organizations must immediately verify if their Enterprise CA hosts are running the July 14 Microsoft updates, as the public availability of the exploit increases the likelihood of active targeting. Security teams should audit their AD CS policies to determine if the "chase" feature is necessary; if not, disabling it provides immediate risk reduction while patching is applied. Additionally, reviewing and potentially lowering the MachineAccountQuota or restricting computer account creation permissions can mitigate the initial foothold required for this attack chain.

TL;DR

• 研究人员公开了名为“Certighost”的利用工具，允许低权限Active Directory用户通过AD CS漏洞冒充域控制器。
• 该漏洞（CVE-2026-54121）源于证书颁发机构在“chase”回退机制中未验证请求提供的CDC主机是否为真实域控，CVSS评分8.8。
• 攻击者可利用生成的Kerberos凭证通过DCSync提取krbtgt哈希，从而完全接管域环境，无需管理员权限或用户交互。
• 微软已于7月14日发布补丁修复此授权不当问题，建议运行企业CA的组织立即更新并应用临时缓解措施。

为什么值得看

这篇文章揭示了一个高危的身份认证绕过漏洞，展示了低权限账户如何通过滥用Windows Active Directory证书服务（AD CS）获得域控制器的完整控制权。对于负责企业身份安全、AD架构及PKI基础设施的管理者而言，理解这一攻击链对于评估现有风险和实施紧急修补至关重要。

技术解析

• 漏洞原理：漏洞位于AD CS的“chase”回退机制中。当CA无法获取终端实体信息时，协议允许请求指定cdc（要联系的AD服务器）和rmd（要解析的机器对象）。CA在未验证cdc是否为真实域控的情况下，直接通过SMB和LDAP连接该主机。
• 攻击链细节：攻击者创建或重用计算机账户，启动恶意的LSA和LDAP监听器，将CA的认证挑战中继到真实的域控以获取objectSid和dNSHostName。随后，攻击者提交包含恶意cdc和rmd属性的请求，CA据此为攻击者控制的机器对象签发包含目标域控身份的证书。
• 权限提升与后果：利用PKINIT协议，攻击者使用签发的证书作为域控制器进行Kerberos认证。由于域控制器拥有目录复制权限，攻击者可使用DCSync技术检索krbtgt密钥，实现域内完全控制。
• 修复与缓解：微软补丁在certpdef.dll中增加了CRequestInstance::_ValidateChaseTargetIsDC函数，验证目标必须是唯一的、DNS名称匹配的且userAccountControl包含SERVER_TRUST_ACCOUNT标志的计算机对象。临时缓解措施可通过certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC禁用chase功能，但可能影响合法注册流程。

行业启示

• 强化AD CS配置审计：组织应审查其企业CA的配置，特别是涉及机器模板和默认配额（ms-DS-MachineAccountQuota）的设置，确保最小化攻击面，并定期更新证书服务组件。
• 监控异常认证行为：鉴于攻击无需管理员权限即可触发，安全团队需加强对Kerberos认证日志、LDAP查询模式以及非预期计算机账户创建的监控，以检测潜在的chase机制滥用尝试。
• 优先处理高CVSS漏洞：CVSS 8.8的高危评分表明该漏洞极易被利用且后果严重。IT运营团队应将此类涉及核心身份基础设施的补丁部署列为最高优先级，即使目前尚无广泛野外利用报告。