Low‑Privilege AD Users Exploit Certighost to Impersonate Domain Controllers

On July 24, researchers H0j3n and Aniq Fakhrul released a working proof‑of‑concept for an Active Directory flaw they dubbed Certighost on thehackernews.com. The attack lets a low‑privileged user request a machine certificate for a domain controller (DC) and then authenticate as that DC using Kerberos. Once authenticated, the attacker can use the DCSync API to pull the krbtgt secret—essentially the master key that allows decryption of all other Kerberos tickets in the domain. This gives the attacker full lateral movement capabilities without ever needing administrator rights.¹

The technique hinges on the fact that DC accounts carry directory replication privileges by design. By tricking the system into issuing a certificate for such a DC account, the attacker bypasses normal privilege checks. After obtaining the certificate, the victim’s own Kerberos service accepts it as a legitimate machine credential, enabling the malicious client to issue a DCSync query. Microsoft has long documented similar misconfigurations; guidance against this pattern dates back to Security Bulletin MS93‑047 from April 1993. Earlier CVE‑2019–0746 exposed analogous escalation paths via MSXML parser flaws, but those were mitigated with later OS updates. The Certighost exploit re‑introduces the same core weakness in modern Windows Server environments where many organizations still rely on legacy delegation settings.

From a privacy standpoint, the impact is significant: once inside the domain, an attacker can impersonate any user, decrypt sensitive data, and exfiltrate credentials or personal information stored across corporate systems. Because no elevation step is required, defenders may not notice until after damage is done. Attackers could automate scans for low‑privileged accounts, then rapidly deploy Certighost to pivot through networks—especially dangerous in poorly segmented infrastructures.

Experts note that while patches have addressed earlier Kerberos-related vulnerabilities, organizations should audit their AD delegation configurations, enforce least‑privilege policies, and monitor for anomalous certificate requests targeting DCs. Network segmentation remains critical; even if an attacker gains lateral movement, proper firewalls can limit access to sensitive resources.

The discovery underscores how seemingly innocuous permissions can be leveraged into powerful attack vectors when combined with existing directory services APIs. As Microsoft continues to release incremental security updates, it will be essential for IT teams to apply all relevant patches promptly and review their Active Directory topologies for potential misconfigurations before attackers can exploit them.