Certighost – Active Directory Certificate Services (ADCS) vulnerability (CVE-2026-54121)

Summary

CVE-2026-54121, also known as Certighost, is a vulnerability that can allow an attacker to obtain a valid Domain Controller certificate and Kerberos cache. Exploitation involves deploying rogue LDAP and SMB/LSA listeners to intercept certificate enrollment requests. This can enable an attacker to impersonate the Domain Controller and perform PKINIT authentication to recover NT hashes.

Investigation

The research describes a proof-of-concept tool called certighost.py that demonstrates exploitation of CVE-2026-54121. The tool automates computer account creation, deployment of rogue listeners on ports 389 and 445, and modification of certificate request attributes such as cdc and rmd. Successful exploitation can result in the extraction of .pfx certificate files and .ccache Kerberos credential caches.

Mitigation

Response

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary intends to exploit CVE-2026-54121 by deploying a rogue service that listens for LDAP requests. To evade detection, the attacker typically uses a Python-based tool. In this simulation, we will execute a script named certighost.py that attempts to open a listener on port 389. This will trigger the TargetImage logic in the Sigma rule and generate the expected EventID 5154/5156 connection logs.

• Regression Test Script:

  # Simulation Script: Mimicking CVE-2026-54121 rogue listener
  # Note: This script creates a dummy file and attempts to bind to a port to trigger telemetry.
  
  $scriptName = "certighost.py"
  $workingDir = "$env:TEMPattack_sim"
  New-Item -ItemType Directory -Force -Path $workingDir
  $scriptPath = Join-Path $workingDir $scriptName
  
  # Create a dummy python script to satisfy the 'TargetImage' detection logic
  @"
  import socket
  print('Starting rogue LDAP listener on port 389...')
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  try:
      s.bind(('0.0.0.0', 389))
      s.listen(1)
      print('Listener active.')
  except Exception as e:
      print(f'Failed to bind: {e}')
  "@ | Out-File -FilePath $scriptPath -Encoding utf8
  
  # Execute the script using python (this triggers the TargetImage match)
  Write-Host "Executing $scriptName to trigger detection..."
  Start-Process "python.exe" -ArgumentList $scriptPath -Wait -WindowStyle Hidden
  
  Write-Host "Simulation complete. Check SIEM for EventID 5154/5156 or TargetImage matching certighost.py"

• Cleanup Commands:

  # Cleanup Simulation Artifacts
  $workingDir = "$env:TEMPattack_sim"
  if (Test-Path $workingDir) {
      Remove-Item -Recurse -Force $workingDir
      Write-Host "Cleanup successful: $workingDir removed."
  } else {
      Write-Host "Cleanup skipped: Directory not found."
  }