Researchers H0j3n and Aniq Fakhrul disclosed a working exploit on July 24 that abuses Active Directory certificate services to let low-privileged users impersonate Domain Controllers. The flaw, named Certighost, bypasses standard authentication barriers by allowing attackers to obtain legitimate Domain Controller certificates through normal AD certificate request processes.

Domain Controller accounts hold directory replication rights that low-privileged users cannot access directly. By obtaining a DC certificate through Certighost, attackers generate valid Kerberos credentials that grant them DC-level privileges. These credentials enable DCSync attacks, a technique that extracts the krbtgt secret from Active Directory. This secret unlocks the ability to forge golden tickets, which are Kerberos tokens that persist in the environment indefinitely and allow unrestricted network access.

The attack chain requires only low-level domain user credentials to initiate. Attackers need no special permissions or elevated access to launch Certighost. This makes the vulnerability exceptionally dangerous in any organization running Active Directory with certificate services enabled. Once an attacker obtains krbtgt, they maintain permanent access even after credential resets and password changes.

Organizations using Active Directory Certificate Services (ADCS) face immediate risk. Attackers with domain user accounts, including compromised contractors or insider threats, can weaponize Certighost to achieve complete directory compromise. The resulting golden tickets survive defensive rotations and isolation attempts.

Remediation requires reviewing certificate templates for overly permissive enrollment rights and restricting which users can request DC certificates. Organizations should immediately audit certificate template configurations and disable enrollment for standard users on templates that permit DC impersonation. Monitoring DCSync activity and Kerberos golden ticket generation remains essential until patching completes.

The public exploit availability accelerates adoption by threat actors. Organizations should treat Certighost with the same