Certighost Abusing the AD CS Chase Fallback to Impersonate a...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
• Blog Title: Certighost: Abusing the AD CS Chase Fallback to Impersonate a Domain Controller (CVE-2026-54121)
• Suggested Section: Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation, as a dedicated Certighost / AD CS Chase Fallback identity-substitution page

🎯 Content Summary

Overview

Certighost (CVE-2026-54121) is an Active Directory Certificate Services (AD CS) enrollment vulnerability documented by @H0j3n and @aniqfakhrul on July 24, 2026. In the tested configuration, a low-privileged Domain Users account could make an Enterprise Certification Authority obtain identity information from an attacker-controlled host, issue a CA-signed certificate representing a Domain Controller, and allow...

🔧 Technical Details

Redirecting trusted backend identity resolution: When a certificate or identity service accepts requester-controlled fields that separately select a lookup endpoint and a target principal, test whether the endpoint can be redirected to attacker-controlled infrastructure. In this technique, cdc selects the remote host while rmd selects the principal to resolve. If the server contacts the selected endpoint without proving that it is authoritative for the requested identity, the lookup can become an identity-substitution primitive.

Turning an outbound connection into signed identity forgery: A server-side connection is significantly more dangerous when the vulnerable service consumes the response as trusted identity data. Rogue LDAP/LSA services can return a victim's attributes, such as objectSid and dNSHostName, causing a CA to place attacker-selected mapping information into a legitimately sig...

🤖 Agent Actions

Done — I updated:

• src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md

Added a new section for the AD CS chase-fallback identity-substitution technique behind Certighost (CVE-2026-54121), including:

• root cause / trust-boundary explanation
• cdc + rmd abuse flow
• ms-DS-MachineAccountQuota machine-account bridge
• PKINIT to DC impersonation
• direct DCSync follow-up
• technical detection/hardening notes
• references to the original gist, NVD, and Microsoft audit docs

I kept it to a single file and verified the markdown structure afterward.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation, as a dedicated Certighost / AD CS Chase Fallback identity-substitution page".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0