aniqfakhrul/CVE-2026-54121

What it is

Certighost is a self-contained Python PoC for CVE-2026-54121 targeting Active Directory Certificate Services (AD CS). The repo (aniqfakhrul/CVE-2026-54121) implements the attack as a single script, certighost.py.

How it works

The script creates a new low-privileged computer account (e.g. GHOSTABCDEFGH$), or reuses one supplied via --computer-name. It then starts two rogue listeners on the attacker host: an SMB/LSA server on port 445 and an LDAP server on port 389. A certificate request is sent as the new computer account, embedding a custom cdc attribute pointing to the attacker's IP (auto-detected or set via --listener) and an rmd attribute carrying the target DC's DNS name. The CA connects back to the rogue listeners, which authenticate as the created account — validated against the real DC over Netlogon — then answer the CA's identity lookups with the target DC's sAMAccountName, SID, and dNSHostName instead of the rogue account's own identity. The CA issues a certificate for the DC, and the script performs PKINIT with that certificate to retrieve the DC's TGT/ccache and NT hash.

sequenceDiagram
    participant Attacker as Rogue SMB/LDAP (attacker)
    participant CA
    participant DC
    Attacker->>CA: Cert request as lowpriv account (cdc=attacker IP, rmd=DC name)
    CA->>Attacker: Netlogon/LDAP identity lookup
    Attacker->>DC: Validate account via real Netlogon
    Attacker->>CA: Return DC's identity (sAMAccountName/SID/dNSHostName)
    CA->>Attacker: Issue certificate bound to DC
    Attacker->>DC: PKINIT with DC cert
    DC->>Attacker: TGT/ccache + NT hash

Preconditions / Affected

Requires only a single low-privileged domain account. The attacker host must run as root, since the rogue SMB and LDAP listeners bind to privileged ports 445 and 389. Two CA configuration variants are handled explicitly: CAs hosted directly on a Domain Controller, and CAs with ESC6-style EDITF_ATTRIBUTESUBJECTALTNAME2 enabled that honor request-supplied SANs.

What to do

Install dependencies and run the PoC:

sudo pip install --break-system-packages git+https://github.com/fortra/impacket.git cryptography pyasn1 asn1crypto pycryptodome dnspython
sudo python3 certighost.py -d playground.local -u lowpriv -p 'Password1234' --dc-ip 192.168.1.10

Successful runs drop a .pfx and .ccache for the target DC in the current directory. Two fixes are baked into the script: a hotpatch of the rogue SMB NetLogon path that sets the E bit (0x20) alongside the K bit (0x800) in ParameterControl per MS-NRPC 2.2.1.4.15 — avoiding STATUS_NOLOGON_SERVER_TRUST_ACCOUNT without needing a forked Impacket — and a SAN-spoofing adjustment that sets SAN:dns to the target DC's name (rmd_value) to avoid KDC_ERR_CLIENT_NAME_MISMATCH on CAs honoring request-supplied SANs (ESC6).

Caveats

The SAN fix is described as a no-op on CAs that build certificates strictly from AD templates (i.e., it only matters when request-supplied SANs are honored). Detailed root-cause analysis lives in an external gist, not reproduced here.