Certighost: New Exploit Turns Ordinary Windows Users Into Domain Controllers

Key points

• Researchers H0j3n and Aniq Fakhrul released a working exploit on July 24 for a flaw they call Certighost.
• The bug lets any low-privileged Active Directory user request a certificate as if they were a Domain Controller.
• Once impersonating the Domain Controller, the attacker can pull the krbtgt secret, the master key to every user's login in the network.
• Any Windows environment running Active Directory Certificate Services with common misconfigurations is potentially exposed.
• Defenders should audit certificate templates now and hunt for suspicious certificate requests tied to machine accounts.

A new attack technique published last week hands ordinary Windows users the keys to the entire company network. Two researchers, H0j3n and Aniq Fakhrul, released working code on July 24 that they nicknamed Certighost.

The short version: a normal employee account, the kind issued to a receptionist or an intern, can be turned into the digital equivalent of the building's master keyholder.

What is Certighost, in plain English?

Certighost is a way to trick a Windows network into issuing a security badge meant for a Domain Controller (the servers that decide who is allowed to log in anywhere in the company) to a regular user account. Once the attacker holds that badge, Windows treats them as the server itself.

Active Directory is the system almost every large organisation uses to manage staff logins, file access and email. Domain Controllers sit at the top of that system. If you can pretend to be one, you can ask the network for anything.

The flaw abuses Active Directory Certificate Services, the built-in Microsoft feature that hands out digital certificates. In many networks, certificate templates are configured loosely enough that a low-privileged user can request a certificate on behalf of a computer account, including a Domain Controller.

How bad is it?

Bad. The exploit chain ends with something called DCSync, a technique that asks the network politely for a copy of every password hash it holds, because Domain Controllers routinely replicate that data to each other.

The prize is the krbtgt account secret. That secret signs the tickets Windows uses to prove who you are. Anyone holding it can mint what defenders call a Golden Ticket, a forged credential that grants access as any user, including administrators, for as long as the secret stays unchanged (which in many networks is years).

In practical terms: full network takeover, from a starting point that most companies hand out on day one of employment.

Who is affected?

Organisations running Active Directory Certificate Services with vulnerable certificate template settings. That covers a large share of enterprise Windows environments. The Hacker News, which first flagged the public exploit, notes the technique builds on well-documented weaknesses in how certificate templates are provisioned.

There is no single patch to install here. Certighost is a configuration and design problem, not a memory bug, so fixing it means auditing templates and tightening enrolment rights.

What should defenders do today?

Start with certificate templates. Review every template that permits client authentication and check who can enrol. Any template that lets domain users request certificates with a subject alternative name they control, or on behalf of another account, needs immediate attention.

Microsoft published guidance on hardening AD CS after the original ESC1 through ESC8 research from SpecterOps, and that guidance covers most of what Certighost abuses. Rotate the krbtgt password twice (the standard procedure) if you suspect any exposure.

Monitor for certificate requests tied to machine accounts coming from unexpected users. Those events are logged, if you are collecting them.