🔴 Critical | Source: The Hacker News
A working exploit named Certighost allows any low-privileged Active Directory user to obtain a certificate impersonating a Domain Controller, then use that certificate to authenticate as the DC via Kerberos. Because Domain Controllers hold directory replication privileges, an attacker can leverage this to run a DCSync attack and extract the krbtgt password hash, effectively compromising the entire domain. Published exploit code is already publicly available, making this an immediate operational risk.
Security Architect’s Take: Audit Active Directory Certificate Services (AD CS) templates immediately for misconfigured enrolment permissions that allow low-privileged users to request DC-equivalent certificates, and enable Certificate Authority Web Enrolment restrictions. Consider deploying alerts for anomalous certificate requests and DCSync activity via your SIEM, and review whether Entra ID hybrid-joined environments expose your cloud tenancy to lateral movement from a compromised on-premises AD.
Original advisory: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller