A newly disclosed attack chain, dubbed Certighost, allows a standard Active Directory user to escalate directly to Domain Controller (DC) identity and forge golden tickets for persistent domain compromise. Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, 2026, demonstrating how misconfigured Active Directory Certificate Services (AD CS) templates can be weaponized.
The attack exploits the trust boundary between certificate issuance and Kerberos authentication. A low-privilege account can request a certificate from a template configured for DC computer accounts. When this certificate is granted, it enables Kerberos authentication as the DC itself. Since DC accounts possess directory replication privileges, the attacker can then execute a DCSync operation to extract the krbtgt hash—the cryptographic key needed to create golden tickets for unrestricted, backdoor access.
This creates a dangerously short and stealthy escalation path. The initial certificate request appears as normal PKI activity, and the subsequent DCSync originates from what Active Directory recognizes as a legitimate Domain Controller. Consequently, standard lateral movement detection tools, which typically monitor for suspicious user-to-admin transitions, may not trigger alerts. The result is high-impact, persistent access with a minimal forensic footprint.
The root cause is a collapse in the trust model between identity and infrastructure services. Certificate templates that grant broad enrollment rights and include the Client Authentication extended key usage effectively establish the PKI as an alternative authentication authority. When such templates can be used to request certificates for machine accounts—especially DCs—the consequences are severe. A single misconfigured template can become as potent as a direct Domain Admin credential.
For organizations operating AD CS, the public availability of Certighost exploit code demands immediate attention. Remediation is primarily a configuration task, not a patch dependency. Priority actions include a comprehensive audit of all certificate templates permitting user or computer enrollment and marked for Client Authentication. Enroll and Autoenroll permissions, particularly for standard user groups, must be restricted or removed from any template that can target machine accounts or privileged identities. Templates associated with DCs and service accounts require the highest level of scrutiny.
Effective detection requires monitoring for two key signals. Security teams should alert on any DCSync request that does not originate from a known, authorized Domain Controller. Concurrently, they should watch for anomalous certificate enrollment requests, especially those for computer objects or high-privilege accounts submitted by non-administrative users. These two indicators form a practical defense-in-depth pair against the Certighost chain.
The broader implication is that certificate services are no longer a peripheral IT function; they are on the critical path to domain security. Misconfigurations that organizations may have deprioritized can now equate to total domain compromise. As identity-centric attacks evolve, treating PKI configuration with the same rigor as privileged-access management is essential. While Microsoft and security vendors are expected to refine detection guidance, the vulnerability's fix lies in administrative control—every day a permissive template remains exposed increases risk. Administrators should begin template reviews and ensure monitoring covers both certificate enrollment and replication activities immediately.
新披露的攻擊鏈被命名為 Certighost，允許標準 Active Directory 用戶直接提升至域控制器 (DC) 身份，並偽造金票以實現持久域入侵。研究人員 H0j3n 和 Aniq Fakhrul 於 2026 年 7 月 24 日發布了一個可用漏洞利用程序，展示了配置錯誤的 Active Directory 證書服務 (AD CS) 模板如何被武器化。
此攻擊利用了證書頒發與 Kerberos 認證之間的信任邊界。低權限帳戶可以從配置為 DC 電腦帳戶的模板中請求證書。當該證書被授予時，它就能實現以 DC 身份進行 Kerberos 認證。由於 DC 帳戶擁有目錄複製權限，攻擊者隨後可以執行 DCSync 操作來提取 krbtgt 哈希值——即創建金票所需的加密密鑰，從而實現無限制的後門訪問。
這創造了一條極其短暫且隱蔽的提升路徑。最初的證書請求表現為正常的 PKI 活動，而隨後的 DCSync 操作則源於 Active Directory 所認可的合法域控制器。因此，標準的橫向移動檢測工具通常監控可疑的用戶到管理員的轉換，可能不會觸發警報。結果是造成高影響力、持久性的訪問，且留下極少的數位取證痕跡。
根本原因在於身份與基礎設施服務之間信任模型的崩潰。那些授予廣泛註冊權限並包含客戶端認證擴展金鑰用法的證書模板，實際上將 PKI 建立為替代的認證權威。當此類模板可用於請求電腦帳戶（尤其是 DC）的證書時，後果將非常嚴重。單個配置錯誤的模板可能變得與直接取得域管理員憑證一樣強大。
對於運行 AD CS 的組織，Certighost 漏洞利用代碼的公開發布要求立即關注。修復措施主要是配置任務，而非依賴補丁。優先行動包括全面審計所有允許用戶或電腦註冊並標記為客戶端認證的證書模板。必須限制或移除針對電腦帳戶或特權身份的模板的註冊和自動註冊權限，尤其是針對標準用戶群組的權限。與 DC 和服務帳戶相關的模板需要最高程度的審查。
有效的檢測需要監控兩個關鍵信號。安全團隊應對任何不來自已知、授權域控制器的 DCSync 請求發出警報。同時，他們應關注異常的證書註冊請求，尤其是由非管理員用戶提交的、針對電腦對象或高特權帳戶的請求。這兩個指標構成了一對實用的縱深防御組合，以抵御 Certighost 攻擊鏈。
更廣泛的影響是，證書服務不再僅是周邊 IT 功能；它已處於域安全的關鍵路徑上。組織可能已降低優先級的配置錯誤，現在等同於整個域的完全入侵。隨著以身份為中心的攻擊手段不斷演進，以與特權訪問管理相同的嚴謹性對待 PKI 配置至關重要。雖然微軟和安全廠商預計會完善檢測指南，但此漏洞的修復在於管理控制——每多一天暴露一個寬鬆模板，風險就會增加一分。管理員應立即開始模板審查，並確保監控覆蓋證書註冊和複製活動。