New Certighost PoC exploit lets attackers hijack Windows domains
A proof-of-concept exploit for the Certighost vulnerability in Windows Active Directory Certificate Services has been released, allowing attackers to potentially compromise a Windows domain. The vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday s…
Intelligence analysis by Llama
A proof-of-concept exploit for the Certighost vulnerability in Windows Active Directory Certificate Services has been released, allowing attackers to potentially compromise a Windows domain. The vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday security updates. The exploit allows attackers to manipulate attributes associated with a machine account and obtain…
Imagine you have a special key that can unlock a door. But, what if someone could make a fake key that looked exactly like the real one? That's kind of what's happening with the Certighost vulnerability. Attackers can make a fake key that looks like it belongs to a real door, and then use it to unlock the door and get inside. But, the good news is that Microsoft has fixed the problem, and we can all breathe a sigh of relief.
Analysis
A Critical Vulnerability in Windows Active Directory Certificate Services
The Certighost vulnerability in Windows Active Directory Certificate Services is a critical issue that can be exploited by attackers to compromise a Windows domain. The vulnerability allows attackers to manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT.
The attack flow demonstrated by the researchers involves creating a machine account, which is permitted under the default ms-DS-MachineAccountQuota configuration. A machine account created through the default ms-DS-MachineAccountQuota setting is a valid domain principal, allowing the attacker-controlled chase endpoint to satisfy the authentication checks needed for the CA to continue, even though it was not the Domain Controller being impersonated.
The attacker then submits a certificate request that directs the CA to the rogue services and targets a domain controller account. Because the CA trusts the identity information returned by the attacker-controlled services, it issues a certificate that can be used to authenticate as that domain controller and perform Active Directory operations.
The released certighost.py proof-of-concept automates this process by using the certificate to authenticate through PKINIT as the targeted domain controller, saving the resulting Kerberos credentials to a .ccache file and extracting the account’s NT hash. The researchers then demonstrated using the saved Kerberos credentials with Impacket's secretsdump tool to perform a DCSync attack and retrieve the krbtgt account's credentials.
Microsoft’s Fix for the Vulnerability
Microsoft fixed the vulnerability as part of the July Patch Tuesday updates by adding validation to this chase process. The CA now verifies that the server specified in the cdc attribute maps to a legitimate domain controller in Active Directory and confirms that the returned identity matches the expected account.
Workaround for Admins Who Cannot Install the July Security Updates
For admins who cannot install the July security updates, the researchers say that you can disable the optional chase fallback using the following commands: certutil -setreg policy/EditFlags -EDITF_ENABLECHASECLIENTDC Restart-Service CertSvc -Force
However, the researchers stress that this workaround is only a temporary mitigation and has not been fully tested in production environments. Therefore, admins should prioritize installing the latest security updates as soon as possible.
Key points
- A proof-of-concept exploit for the Certighost vulnerability in Windows Active Directory Certificate Services has been released.
- The vulnerability allows attackers to manipulate attributes associated with a machine account and obtain a certificate from Active Directory Certificate Services that allows authentication as that machine via PKINIT.
- Microsoft fixed the vulnerability as part of the July Patch Tuesday updates by adding validation to the chase process.
- A workaround is available for admins who cannot install the July security updates, but it is only a temporary mitigation and has not been fully tested in production environments.
The release of the Certighost exploit highlights the importance of staying up-to-date with the latest security patches. Microsoft's quick response to the vulnerability and the release of the July Patch Tuesday updates demonstrate their commitment to securing Windows domains. As a result, users can feel more confident in the security of their systems, and the risk of exploitation is reduced.
The release of the Certighost exploit also highlights the potential risks of not installing security updates in a timely manner. Admins who cannot install the July security updates may be left vulnerable to exploitation, and the workaround provided by the researchers is only a temporary mitigation. Therefore, it is essential to prioritize installing the latest security updates as soon as possible to minimize the risk of exploitation.
