Certighost: Low-Priv AD Users Can Impersonate DCs

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that puts full domain compromise within reach of any low-privileged Active Directory user. They codenamed it Certighost. No CVE has been assigned at time of publication; this is a public exploit drop, effective today.

The chain: a low-privileged user obtains an X.509 certificate for a Domain Controller through Active Directory’s certificate infrastructure, then uses that credential to authenticate as the DC machine account. Domain Controller accounts hold directory replication rights by design — that’s the foundation DCSync operates on. Once Certighost gets you there, you pull the krbtgt hash and own the Kerberos trust chain for the domain. The full technical writeup is at The Hacker News.

Microsoft has not issued a patch advisory at time of writing. Watch the Microsoft Security Response Center for updates.

What to do

Audit certificate template enrollment rights now. If any non-DC principal can enroll on a Domain Controller certificate template in your PKI, that’s your exposure. Lock enrollment to the Domain Controllers security group. This is standard ADCS hardening — Certighost turns “recommended” into “do it this week.”

Review certificate request logs for anomalous enrollments. Windows Security events 4886 and 4887 cover certificate service requests and issuances. If any non-DC account appears in those logs requesting DC authentication certificates, treat it as an active incident until proven otherwise.

Enable Protected Users for privileged accounts. Protected Users restricts how credential material obtained via DCSync can be weaponized. It won’t block the initial certificate abuse, but it raises the cost of the follow-on.

Priority call

If you’re running Active Directory Certificate Services — most enterprise Windows environments are — audit DC certificate template enrollment permissions before the weekend. The exploit is already public. Assume capable threat actors have it.

If you’re not running ADCS, your immediate risk surface is lower. Still worth confirming: if a third-party PKI is integrated with AD machine accounts, verify your enrollment controls are equivalently locked down.

This is also a good time to review the broader pattern. Microsoft’s infrastructure has had a rough month: Bing’s image-processing tier ran code as SYSTEM via crafted SVGs, the SharePoint deserialization flaw hit CISA’s KEV catalog. Certighost is a different attack class — certificate infrastructure, not server-side processing — but the operational posture is the same: audit your exposure, prioritize, patch or compensate fast.