New Certighost PoC exploit lets attackers hijack Windows domains

Impact

In real-world scenarios, an attacker exploiting Certighost can escalate from a low-privileged domain user to a domain administrator by forging or requesting certificates that grant high-level privileges. This enables stealthy persistence, lateral movement, and full domain compromise without triggering typical credential theft alarms. Attack chains may start with phishing or credential theft to gain initial access, followed by exploitation of AD CS to obtain a rogue certificate. The attacker can then impersonate domain controllers or services, deploy malware signed with trusted certificates, and disable security controls. Enterprises relying heavily on Active Directory for authentication and authorization are at high risk, especially those with complex certificate templates or insufficiently restricted enrollment permissions. Government agencies and critical infrastructure operators face severe consequences, including espionage, data exfiltration, and operational disruption. Secondary impacts include undermining trust in PKI infrastructure, complicating incident response, and enabling long-term undetected access. The exploit’s ability to bypass traditional credential-based defenses and leverage trusted certificates makes it a potent tool for advanced persistent threat (APT) actors.