marcgoam GitHub avatar

CVE-2026-54121-CertiGhost

marcgoam

A patched fork of the proof-of-concept tool for CVE-2026-54121 (Certighost) that fixes SAN handling, computer-account reuse, and --target-san parsing to reliably exploit Active Directory certificate services and obtain domain controller credentials.

Stars

6

7-day growth

No data

Forks

2

Open issues

2

License

No data

Last updated

2026-07-27

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It fixes critical issues in the original PoC—SAN mismatch causing PKINIT failure and quota exhaustion from orphaned accounts—making the attack more reliable and practical for authorized security testing.

Who it is for

  • Security researchers studying ADCS attacks
  • Penetration testers performing internal infrastructure assessments
  • Red team operators simulating advanced persistent threats
  • Active Directory administrators evaluating vulnerability impact

Use cases

  • Escalating privileges from a low-privileged domain user to a domain controller
  • Testing Active Directory Certificate Services for misconfigurations
  • Demonstrating PKINIT abuse and certificate-based authentication bypass
  • Assessing the security posture of a Windows domain environment

Strengths

  • Fixes SAN to use target DC's dNSHostName, enabling successful PKINIT where the original failed
  • Reuses a single stable computer account to avoid exhausting the ms-DS-MachineAccountQuota
  • Robust --target-san parsing accepts multiple input formats (short name, trailing $, FQDN)
  • Clear usage instructions and a warning about the leftover account for operational awareness

Considerations

  • Requires root privileges because it binds to privileged ports 389 (LDAP) and 445 (SMB)
  • Leaves a computer account (CERTIGHOST$) in AD that only a Domain Admin can delete
  • Effectiveness depends on the CA honoring the requested SAN in the certificate request

README quick start

Usage

Description

CVE-2026-54121 (Certighost) AD CS DC-impersonation PoC. Patched SAN handling + MAQ-safe account reuse.

Related repositories

Similar projects matched by category, topics, and programming language.

lopopolo
Featured
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI & Machine LearningAI Agents
2,390
slvDev
Featured
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI & Machine LearningLarge Language Models
1,960
littledivy
Featured
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI & Machine Learning
1,482