Certighost PoC Released: Authenticated Attackers Can Now Hijack Windows Domains

What Happened

A working proof-of-concept exploit for Certighost has been publicly released, targeting a vulnerability in Windows Active Directory Certificate Services (AD CS). According to BleepingComputer, the exploit allows any authenticated domain user — no admin rights required — to potentially compromise an entire Windows domain.

This is not a theoretical bug report. There is now functional exploit code in the wild.

Why It Matters

AD CS is the backbone of certificate-based authentication in most enterprise Windows environments. It underpins smart card login, VPN auth, code signing, and — critically — the ability to impersonate any principal in the domain, including domain controllers.

This class of AD CS attack, broadly known as ESC-style abuse, has become one of the most reliable paths to full domain takeover since the original Certified Pre-Owned research landed in 2021. Certighost follows that playbook: once an attacker can coerce or request a certificate for a privileged account, they can obtain a Kerberos TGT for that account and own the domain.

The bar here is low. Authenticated means any compromised workstation, any phished user, any intern account. The blast radius is total domain compromise.

With a PoC public, the window between disclosure and active exploitation is measured in days — sometimes hours. Ransomware operators and initial access brokers monitor these releases closely.

What To Do

Immediate (today):

1. Audit your AD CS configuration. Run Certify or Locksmith against your environment to enumerate misconfigured certificate templates. Look for templates with ENROLLEE_SUPPLIES_SUBJECT enabled and enrollment rights granted to low-privilege groups.

1. Check for the specific Certighost condition. Review the BleepingComputer writeup for the precise template attributes being abused. Restrict or disable any matching templates immediately.

1. Enable Certificate Authority Web Enrollment audit logging if not already active. You want visibility into who is requesting what certs.

1. Apply Microsoft patches. Confirm your AD CS servers are fully current — check Windows Update history on each CA host specifically.

Short-term (this week):

• Enforce the StrongCertificateBindingEnforcement registry key on domain controllers if you haven't already. Microsoft has been phasing this in; verify it's set to 2 (full enforcement) rather than compatibility mode.
• Review which accounts have ManageCA or ManageCertificates rights — these should be tightly scoped.
• Consider deploying PKI Audit for ongoing certificate issuance monitoring.

If your organization does not run AD CS, you are not affected. If you do, treat this as a P1 until the configuration is verified clean.