Certighost Flaw Lets Attackers Impersonate Domain Controllers
A new exploit allows low-privilege users to obtain DC certificates and escalate privileges. This vulnerability poses a serious risk to Active Directory environments.
TL;DR
- Researchers disclosed Certighost, a new exploit targeting Active Directory certificate services.
- It enables low-privilege users to impersonate Domain Controllers and gain replication rights.
- Successful exploitation leads to retrieval of the krbtgt account secret using DCSync.
- Organizations should audit certificate templates and monitor for suspicious authentication requests.
- Patch management and privilege reviews are critical mitigation steps.
Security researchers have revealed a new Active Directory exploit called Certighost that enables low-privilege users to impersonate Domain Controllers. By obtaining a certificate for a Domain Controller, attackers can authenticate as that trusted system and leverage its elevated permissions.
Once authenticated, the attacker gains directory replication rights typically reserved for Domain Controllers. These rights allow them to perform a DCSync attack, retrieving the highly sensitive krbtgt account secret. Access to this credential can lead to Golden Ticket attacks and persistent domain compromise.
How Certighost Works
- The exploit abuses misconfigured Certificate Templates in Active Directory Certificate Services (AD CS).
- Low-privilege users request a certificate specifying a Domain Controller's identity.
- If templates allow enrollee-supplied subjects, the DC name can be spoofed during enrollment.
- The issued certificate grants the attacker the ability to authenticate as the targeted Domain Controller.
Impact and Mitigation
- Successful exploitation results in full domain compromise via credential theft.
- Attackers can extract the krbtgt hash and create Golden Tickets for persistent access.
- Organizations should review AD CS templates to prevent user-defined subject names.
- Enable Certificate Manager (CA) approval requirements for high-risk templates.
- Monitor logs for unexpected certificate issuance or unusual Domain Controller activity.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.