aniqfakhrul/cve-2026-54121

This repository contains a proof-of-concept tool demonstrating a security vulnerability tracked as CVE-2026-54121, nicknamed Certighost. The tool shows how an attacker with limited privileges in a Windows domain environment can trick a certificate authority into issuing a valid certificate for a domain controller, which then allows the attacker to impersonate that controller and take over the domain. A detailed analysis of the vulnerability is linked from the README. The script works through a multi-step process. First, it creates a new computer account in the domain or reuses one the attacker specifies. It then starts two fake services on the attacker's machine, one mimicking a Windows file sharing service on port 445 and another mimicking a directory lookup service on port 389. These fake services are designed to intercept and respond to queries from the legitimate certificate authority. Next, the tool sends a certificate request on behalf of the newly created computer account. This request embeds special attributes that trick the certificate authority into contacting the attacker's fake services instead of the real domain controller. When the certificate authority connects to verify the request, the fake services authenticate using the attacker's computer account but respond with the identity information of the real domain controller, including its name and security identifier. Because the certificate authority believes it is issuing a certificate to the domain controller, it produces a valid certificate for that powerful account. The script then takes the final step of using this certificate to request Kerberos authentication tickets and an NT hash, giving the attacker the credentials needed to fully impersonate the domain controller. The tool must be run with administrator privileges because the fake services require access to privileged network ports. The README provides a sample command showing the required inputs, including the domain name, username, password, and the IP address of the target domain controller. Successful execution saves the stolen certificate and authentication cache files to the current directory.