Certighost: Working Exploit Reaches AD Domain Controllers
Researchers published a working Certighost exploit: any AD user can obtain a Domain Controller certificate and run DCSync to extract the krbtgt hash. No CVE assigned.
Loop Active Directory Certificate Services issues machine certificates. Domain Controller accounts hold directory replication rights. Those two facts have been sitting next to each other for years. On July 24, researchers H0j3n and Aniq Fakhrul published a working exploit — named Certighost — that connects them into a complete domain compromise path from a standard low-privileged user account.
No CVE has been assigned at time of publication. No Microsoft advisory is out.
What the chain does
A Domain Controller’s machine account is privileged in a specific way: it can request a domain replication, which retrieves password hashes for every account in the domain — including krbtgt, the key material that underpins Kerberos ticket forgery. That operation (DCSync) is normally gated to domain admins and domain controllers.
Certighost gets there through certificate enrollment. If an AD CS template allows enrollees to specify a Subject Alternative Name (the ENROLLEE_SUPPLIES_SUBJECT flag) and that template is accessible to regular domain users, any authenticated user can request a certificate that names a Domain Controller as the subject. That certificate is then valid for PKINIT — Kerberos authentication using a certificate instead of a password. Once the authentication succeeds as the DC machine account, DCSync runs.
The published exploit requires:
- A standard authenticated domain user account
- A certificate template with
ENROLLEE_SUPPLIES_SUBJECTenabled, accessible to unprivileged users or the Domain Users group - The template accepted by a CA that domain controllers also enroll against
No administrator rights. No local access to any domain controller. Full technical disclosure via The Hacker News; this writeup does not reproduce the exploitation mechanics.
What to check
The attack surface is the same configuration that Specterops documented as ESC1 in their 2021 AD CS research. If your environment was audited against ESC1 and the misconfigured templates were disabled or protected since then, Certighost does not add new exposure.
If that audit hasn’t happened:
- Run Certipy or Certify to enumerate certificate templates. Flag any with
ENROLLEE_SUPPLIES_SUBJECTthat permit enrollment for Domain Users or broad groups. - Disable
ENROLLEE_SUPPLIES_SUBJECTon any template that doesn’t require caller-supplied SANs for a documented business reason. - Gate remaining legitimate uses on CA Manager Approval to break the unattended enrollment path.
Microsoft’s hardening guidance for AD CS is in KB5014754, which introduced enforcement mode for certificate-based authentication on domain controllers — check whether enforcement mode is actually on, not just configured in compatibility mode.
The working exploit being public moves this from “theoretical gap in a known category” to “patch your enrollment templates this week.”
Source: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller — The Hacker News, July 24, 2026.
Found this useful? Share it.
