As reported by The Hacker News, security researchers H0j3n and Aniq Fakhrul publicly released a working exploit on July 24 that enables a low-privileged Active Directory user to impersonate a Domain Controller through certificate abuse — a technique the researchers have dubbed Certighost. The implications are severe: successful exploitation leads directly to a DCSync attack, exposing the krbtgt hash and enabling full domain takeover.
Why This Is a Five-Alarm Fire for AD Environments
The AD CS (Active Directory Certificate Services) attack surface has been under intense scrutiny since SpecterOps researchers introduced the ESC class of vulnerabilities in 2021. Certighost appears to represent a further refinement of certificate-based privilege escalation — but its impact is categorically different from many prior findings. The attack does not require an existing foothold on a privileged account or a misconfigured certificate template with obvious red flags. A standard domain user account is the only prerequisite.
The chain is devastatingly clean: obtain a certificate for the Domain Controller machine account → authenticate via Kerberos using that certificate (PKINIT) → leverage the resulting DC-level credential to execute DCSync → extract krbtgt and all domain account hashes. At that point, the attacker can forge Golden Tickets, persist indefinitely, and move laterally to any system in the forest.
Shield53 Assessment: Any organization running Active Directory Certificate Services without strict enrollment controls and template auditing should treat this as a critical-severity incident response scenario, not a scheduled patch cycle item.
Who Is at Risk
The DCSync Endgame — Why krbtgt Matters
DCSync is not simply another lateral movement technique — it is a domain-ending capability. Possession of the krbtgt hash allows an attacker to forge Kerberos Ticket Granting Tickets (Golden Tickets) for any account in the domain, including accounts that do not exist. These tickets can be valid for years and are extraordinarily difficult to detect without specific tooling. Even a full password reset of the krbtgt account (which Microsoft recommends running twice in sequence) does not invalidate previously forged tickets immediately.
This is precisely why certificate-based DC impersonation is so dangerous: it transforms a low-privilege credential into an unlimited, persistent presence in the domain in a single, auditable-but-easily-missed step.
Detection Opportunities
Defenders should focus detection engineering on the following telemetry sources:
- Windows Event ID 4886 / 4887: Certificate request and issuance events on the CA server — filter for machine account certificates issued to unexpected requestors.
- Windows Event ID 4768 with Certificate field populated: PKINIT-based Kerberos TGT requests; a domain user account authenticating with a certificate associated with a DC machine account is a high-fidelity indicator.
- Directory Replication Service (DRS) calls from unexpected sources: DCSync generates Event ID 4662 with specific GUID values (replication object rights). A non-DC source triggering these is anomalous.
- Certipy / Certify tooling signatures: EDR behavioral detections on LDAP enumeration of certificate templates and certificate enrollment via DCOM/RPC.
Shield53 Recommendations
Immediate Actions
- Audit all certificate templates immediately using Certipy (
certipy find) or the native PKIVIEW.MSC console. Identify any template where low-privileged users can enroll and the subject can be specified by the requester, or where machine/DC-class certificates are broadly accessible. - Restrict enrollment permissions on any certificate template that allows enrollment by "Authenticated Users" or similarly broad groups, particularly those with Client Authentication or Smart Card Logon EKUs.
- Enable CA Manager Approval on sensitive templates as an emergency interim control if template restrictions cannot be immediately applied.
- Deploy Microsoft's PKI health assessment via the Active Directory Certificate Services Best Practices Analyzer and review the output against current ESC guidance.
- Rotate the krbtgt password twice (with appropriate spacing per Microsoft guidance) if there is any possibility the environment has been previously exposed to AD CS abuse.
Longer-Term Hardening
- Implement Certificate-Based Authentication controls using the StrongCertificateBindingEnforcement registry key (KB5014754) in Full Enforcement mode.
- Deploy Microsoft Defender for Identity or equivalent NDR/EDR capability with specific rules for DCSync and PKINIT anomalies.
- Establish a PKI governance process that requires security review before any new certificate template is published to the domain.
- Consider isolating CA servers from general network access and enforcing enrollment only through dedicated management interfaces.
Certighost is a stark reminder that Active Directory Certificate Services remains one of the most dangerous and under-governed attack surfaces in enterprise Windows environments. The fact that a working public exploit now exists for this technique dramatically lowers the barrier for both opportunistic ransomware operators and sophisticated APT actors. Treating AD CS security as a PKI team problem — rather than a security team priority — is no longer a defensible posture.
