VulnerabilityBleeping Computer
9.0 — CRITICAL
New Certighost PoC exploit lets attackers hijack Windows domains
A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A proof-of-concept exploit for the Certighost vulnerability allows authenticated attackers to hijack Windows domains by manipulating attributes associated with a machine account and obtaining a certificate that enables authentication as the domain controller, potentially leading to privileged Active Directory operations.
⚙️Technical Details
Affected Systems
Windows domain controllers
Attack Vectors
Abusing the AD CS chase mechanism using two certificate request values: cdc (Client DC) and rmd (Remote Domain)Creating a machine account with default ms-DS-MachineAccountQuota configuration
💥Impact Assessment
Severity: critical
Who Is at Risk
Windows domain controllers
🛡️Recommended Actions
1Disable the optional chase fallback using certutil and Restart-Service commands
2Prioritize installing the latest security updates as soon as possible
3Implement additional security measures to prevent exploitation of this vulnerability
📦Affected Products
Software: Windows domain controllers
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.