Loading vulnerability…
Certighost is an elevation-of-privilege vulnerability in Microsoft Active Directory Certificate Services (AD CS). The flaw exists in the Enterprise CA certificate enrollment chase logic, where attacker-controlled request attributes can influence which directory server the CA contacts and which machine account identity it resolves during enrollment. On vulnerable systems, when the optional EDITF_ENABLECHASECLIENTDC behavior is enabled, the CA can trust a requester-supplied chase target without adequately validating that it is a legitimate Domain Controller, and can accept forged identity data for a target machine account. Researchers demonstrated that a low-privileged domain user can abuse this behavior to obtain a CA-signed certificate containing the identity of a targeted Domain Controller. That certificate can then be used with PKINIT to authenticate as the Domain Controller account. Microsoft’s July 2026 fix added validation to ensure the chase target resolves to a legitimate Domain Controller and that the resolved identity matches the expected object.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (6 hidden).
Repository is a Python-based AD CS exploitation toolkit for the claimed CertiGhost vulnerability (CVE-2026-54121). It is not tied to a common exploit framework. The main offensive implementation is in certighost_exploit.py, while certighost_test.py contains both a safer detection workflow and a higher-level exploit CLI, ad_detect.py provides a lightweight detector, and test_exploit.py is a validation suite for exploit components. Primary capability: full multi-stage network attack against Microsoft Active Directory / AD CS. The documented and partially visible code structure shows these stages: LDAP-based discovery of domain/DC/CA metadata; machine account creation via SAMR; SPN registration; attacker-hosted rogue LDAP service on TCP 389 and rogue SMB/relay service on TCP 445; crafted certificate request submission containing cdc and rmd attributes; CA callback/chase to attacker-controlled services; issuance of a certificate for the target DC identity; PKINIT authentication to obtain a TGT as the DC; and DCSync to retrieve secrets such as the krbtgt hash. This is clearly intended as an exploit, not merely a detector. Repository structure: - certighost_exploit.py: main exploit chain and likely primary entry point for destructive exploitation. - certighost_test.py: combined toolkit with detect/exploit/dcsync modes and reusable classes such as CertiGhostDetector. - ad_detect.py: quick non-destructive scanner that probes candidate internal domains, LDAP reachability, and vulnerability indicators. - test_exploit.py: unit/structural tests for BER encoding, SID conversion, CSR/PFX generation, SMB2 packet construction, CLI parsing, and class instantiation. - README.md / USAGE.md / DIAGRAM.md: extensive operator documentation, attack flow diagrams, prerequisites, and example commands. Notable endpoints and observables include LDAP/SMB ports 389 and 445, DNS SRV lookup _ldap._tcp.dc._msdcs.<domain>, LDAP discovery path CN=Enrollment Services,CN=Public Key Services, temporary certificate/key artifacts under /tmp and PEM/PFX files, and example infrastructure values such as 10.0.0.10, 10.0.0.99, dc01.example.com, and example.com. Overall assessment: operational exploit toolkit with hardcoded attack flow and documented post-exploitation path to full domain compromise. Detection functionality is present, but the repository’s core purpose is exploitation of AD CS chase fallback behavior in vulnerable Windows Server AD environments.
Repository contains a single substantial Python exploit, certighost.py, plus a short README with usage instructions. The script is a proof-of-concept but operational exploit for the CertiGhost / cdc-redirect attack chain referenced as CVE-2026-54121. It is not a scanner or detector. The exploit is designed for Microsoft Active Directory environments with AD CS. It uses Impacket, cryptography, asn1crypto, and PyCryptodome to implement a full attack chain: it accepts domain credentials and either an existing controlled computer account hash or password, starts rogue network services on the attacker host (SMB/LSA on 445 and LDAP on 389), requests a certificate from the target CA, saves the resulting PFX, then performs PKINIT as the target machine/account and attempts to recover the NT hash from PAC credential data. The final output includes the target LM/NT hash pair when extraction succeeds and a Kerberos ccache. The README states this variant modifies the original PoC to use a computer object already controlled by the attacker instead of creating a new machine account, avoiding reliance on MachineAccountQuota. Example invocation shows parameters for domain, username, password, DC IP, computer name, and computer NT hash. Structurally, the script appears self-contained and large (~58 KB), with helper routines for debugging/error decoding, certificate handling, Kerberos ASN.1 processing, PAC parsing, LDAP/SMB/DCERPC interactions, and the top-level orchestration in main(). The visible execution flow in main() starts the rogue servers, verifies local listeners, requests a certificate using request_cert(), writes <target>.pfx, then calls pkinit_and_hash() to authenticate and extract credential material. This makes the repository purpose clear: exploitation of an AD CS / certificate redirection weakness to impersonate a target computer account and steal reusable authentication secrets.
Repository contains a single substantial Python exploit script, certighost.py, plus a README describing usage and fork-specific fixes. This is a real exploit PoC for CVE-2026-54121 (Certighost), not a detector. The script targets Microsoft AD CS / Active Directory environments and automates a certificate abuse chain: it authenticates with low-privileged domain credentials, creates or reuses a machine account (default CERTIGHOST$), launches rogue network services on TCP 445 and 389, submits a crafted certificate request that causes the CA to connect back to attacker-controlled listeners, and responds to those CA lookups with spoofed target DC identity data. If successful, the CA issues a certificate for the target DC/computer account. The script then performs PKINIT using the issued PFX, saves a Kerberos ccache, and attempts to extract the NT hash from the PAC. The README explains this fork fixes SAN handling so PKINIT succeeds when the CA honors requested SAN values, broadens target SAN parsing, and avoids machine-account quota exhaustion by reusing a stable computer account instead of creating a new one each run. The code shown confirms the main operational flow: start rogue LSA and LDAP servers, verify local ports are listening, request the certificate, save the resulting PFX, run PKINIT as the target machine, and print recovered hashes/ccache information. Overall, this is an operational Python exploit for AD CS certificate impersonation and credential extraction in vulnerable Windows domain environments.
Repository is a small standalone Python exploit toolkit centered on exploit.py, with supporting README, requirements, and minimal project metadata. The README describes CVE-2026-54121 ('Certighost') as an AD CS elevation-of-privilege issue enabling certificate-based impersonation of a Domain Controller and eventual domain takeover. The code is not part of a known exploit framework like Metasploit or Nuclei; it is a custom standalone script. The main file, exploit.py, is large (~65 KB) and structured as an operational toolkit rather than a minimal PoC. Visible code shows dependency checks, extensive imports for requests/urllib3, Impacket RPC/Kerberos/LDAP/SMB functionality, cryptography/x509 handling, ASN.1 parsing, threading, logging, and optional Shodan integration. The CLI supports single URL input, target lists, or Shodan-derived targets; detection-only versus exploitation mode; threading, timeout, retry, delay, proxying, SSL verification disablement, Tor routing, output formatting, and verbosity controls. This indicates a multi-target scanner/exploitation workflow rather than a single hardcoded exploit attempt. Primary exploit capability: abuse of AD CS certificate enrollment/validation behavior over the network to obtain a privileged certificate. Secondary capabilities inferred from imports and README include certificate generation/handling (x509, pkcs12), Kerberos/PKINIT-related processing, LDAP/RPC interaction with Active Directory services, and possible SMB/DCERPC communications needed for post-exploitation or validation. The README explicitly frames the end goal as privileged certificate issuance leading to Kerberos authentication and DCSync-style domain compromise. Fingerprintable endpoints are sparse in the visible code because the exploit body is truncated, but the README explicitly names the AD CS web enrollment/MSCEP path /certsrv/mscep/mscep.dll as the vulnerable request surface. The script also contains an optional Tor SOCKS proxy endpoint (socks5h://127.0.0.1:9050). No hardcoded victim IPs or domains are visible in the provided content. Overall assessment: this appears to be a real exploit-oriented toolkit, not just a README or pure detector. Because the visible content does not expose a simple shell payload and instead implements a broader certificate/Kerberos abuse workflow, the maturity is best classified as OPERATIONAL.
Repository is a small standalone Python proof-of-concept for CVE-2026-54121 (Certighost), consisting of a README and one main script, certighost.py. The script is not a scanner; it is an active exploitation tool. Its workflow, as described in the README and reflected in the code structure, is: authenticate to AD with supplied low-privileged credentials, create or reuse a machine account, launch attacker-controlled rogue services on SMB/LSA port 445 and LDAP port 389, request a certificate while embedding attacker-controlled redirection metadata, impersonate directory responses so the CA associates the request with the target DC identity, receive a valid DC certificate, save it as a .pfx, then use PKINIT to obtain a Kerberos ccache and extract the DC NT hash from PAC data. The code imports Impacket, cryptography, asn1crypto, and PyCryptodome, indicating substantial protocol handling for NTLM, RPC/LSA, LDAP, Kerberos, PAC parsing, and certificate processing. The exploit is operational rather than a minimal PoC because it automates the full chain from machine-account setup through certificate issuance and post-exploitation credential extraction, but it is still a standalone script rather than a reusable framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
150 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Active Directory Certificate Services vulnerability that lets a low-privileged domain user obtain a certificate for a Domain Controller identity and then authenticate as that DC, enabling domain-wide credential extraction via DCSync.
A vulnerability in Windows Active Directory Certificate Services (AD CS) that allows an authenticated attacker to manipulate machine account attributes and abuse the AD CS chase/fallback mechanism to obtain a certificate for a targeted machine, including domain controllers, enabling domain compromise and privileged Active Directory operations.
A high-severity privilege-escalation vulnerability in Microsoft Active Directory Certificate Services (AD CS) caused by a defective trust boundary in certificate-based client authentication, allowing a low-privileged domain user to impersonate a domain controller and fully compromise an Active Directory environment.
A high-severity identity validation flaw in Active Directory Certificate Services (AD CS) that lets an attacker with basic domain access obtain a valid certificate for a Domain Controller by abusing the CA chase fallback process, potentially leading to full domain compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.