Certighost: New Exploit Turns Ordinary Windows Users Into Domain Controllers

Key points

• Researchers H0j3n and Aniq Fakhrul released a working exploit on July 24 for a flaw they call Certighost.
• The bug lets any low-privileged Active Directory user request a certificate as if they were a Domain Controller.
• Once impersonating the Domain Controller, the attacker can pull the krbtgt secret, the master key to every user's login on the network.
• Any Windows environment running Active Directory Certificate Services with common misconfigurations is potentially exposed.
• Defenders should audit certificate templates now and hunt for suspicious certificate requests tied to machine accounts.

On July 24, two researchers published working attack code that hands an ordinary Windows account the authority of the most privileged server on the network. H0j3n and Aniq Fakhrul codenamed the flaw Certighost.

What is Certighost, in plain English?

Certighost tricks a Windows network into issuing a security certificate meant for a Domain Controller (the servers that decide who can log in anywhere in the organisation) to a regular user account. Windows then treats that user as the server itself.

Active Directory, the system most large organisations use to manage staff logins and file access, puts Domain Controllers at the top of the hierarchy. If you can impersonate one, you can ask the network for anything.

The flaw abuses Active Directory Certificate Services, Microsoft's built-in feature for issuing digital certificates. In many networks, certificate templates are configured loosely enough that a low-privileged user can request a certificate on behalf of a computer account, including a Domain Controller.

How bad is it?

Bad. The exploit chain ends with DCSync, a technique that requests a copy of every password hash the network holds, because Domain Controllers routinely replicate that data between themselves. The attacker gets it because Windows now believes they are one.

The prize is the krbtgt account secret, which signs the tickets Windows uses to prove identity. Anyone holding it can mint a Golden Ticket, a forged credential granting access as any user including administrators, for as long as the secret stays unchanged. In many networks that's years.

Full network takeover, from a starting point most companies hand out on day one of employment.

The technique is worth watching alongside the LegacyHive zero-day we reported on 17 July, which similarly requires no elevated privileges to begin the attack chain.

Who is affected?

Organisations running Active Directory Certificate Services with vulnerable certificate template settings. That covers a large share of enterprise Windows environments.

There's no single patch to install. Certighost is a configuration problem, not a memory bug, so fixing it means auditing templates and tightening enrolment rights.

Should you worry?

Yes, if you haven't audited your certificate templates recently. The attack doesn't require a bug Microsoft can patch out. It requires a misconfiguration that already exists in many production environments, today.

What should defenders do today?

Start with certificate templates. Review every template that permits client authentication and check who can enrol. Any template letting domain users request certificates with a subject alternative name they control, or on behalf of another account, needs immediate attention.

Microsoft published hardening guidance for AD CS following the original ESC1 through ESC8 research from SpecterOps, and that guidance covers most of what Certighost abuses. Rotate the krbtgt password twice (the standard procedure) if you suspect any exposure.

Monitor for certificate requests tied to machine accounts coming from unexpected users. Those events are logged, if you're collecting them.