Certighost Exploit: Domain Controller Impersonation via Active Directory Certificates

Certighost Exploit: Unmasking Domain Controller Impersonation in Active Directory

Runtime Rebel is tracking a significant new exploit, codenamed Certighost, which allows low-privileged Active Directory (AD) users to impersonate a Domain Controller (DC). This sophisticated attack vector, recently detailed by researchers H0j3n and Aniq Fakhrul, presents a critical threat to the integrity of Active Directory environments. The exploit, publicly disclosed on July 24, leverages specific mechanisms within AD and Certificate Services to escalate privileges dramatically, potentially leading to full domain compromise.

According to The Hacker News, the Certighost exploit allows low-privileged users to compromise Active Directory by acquiring a valid certificate for a Domain Controller. Once this certificate is obtained, the attacker can authenticate as the DC itself. Given that Domain Controller accounts possess directory replication rights, this impersonation enables the attacker to perform a DCSync attack, a known TTP for retrieving the highly sensitive krbtgt secret. The compromise of the krbtgt secret is a catastrophic event for any AD domain, as it underpins the Kerberos authentication system, allowing for the forging of ‘golden tickets’ and persistent, undetectable access.

Understanding the Certighost Attack Chain and Its Implications

The core of the Certighost exploit lies in manipulating or misconfiguring Active Directory Certificate Services (AD CS) to issue certificates that grant domain controller privileges to an attacker-controlled account. The process involves several critical steps:

1. Initial Foothold & Enumeration: A low-privileged user gains a foothold within the network. This could be via phishing, compromised credentials, or other common attack vectors. The attacker then enumerates the AD environment, specifically looking for misconfigurations related to Certificate Authorities (CAs) and certificate templates.
2. Certificate Acquisition: The attacker leverages specific flaws (which the researchers codenamed Certighost) to request and obtain a certificate that is intended for a Domain Controller. This is a crucial privilege escalation step, effectively giving the attacker the cryptographic identity of a DC.
3. Domain Controller Impersonation: With the DC certificate in hand, the attacker can then authenticate to the Active Directory as if they were a legitimate Domain Controller.
4. DCSync Attack: Because the impersonated account now possesses directory replication rights (a default privilege for DCs), the attacker can execute a DCSync request. This command allows the attacker to retrieve password hashes and other sensitive information, most notably the krbtgt account’s NTLM hash. The krbtgt account is the master key for Kerberos in the domain.
5. Full Domain Compromise: Once the krbtgt secret is obtained, an attacker can forge Kerberos ‘golden tickets’, granting them arbitrary access to any resource in the domain, effectively achieving full domain control with persistent access, even if the initial compromised account is disabled.

This attack underscores the critical importance of securing every component of an Active Directory infrastructure, particularly those related to identity and authentication mechanisms.

Assessing Risk and Affected Environments

Any organization utilizing Active Directory is potentially susceptible to the Certighost exploit if their Certificate Services are not adequately secured. The risk is particularly high in environments with:

• Misconfigured Certificate Templates: Templates that allow low-privileged users to request certificates with elevated privileges, especially those marked for Domain Controller Authentication or Kerberos Authentication.
• Weak CA Security: CAs that do not enforce strict authorization for certificate issuance.
• Insufficient Monitoring: Lack of effective logging and alerting for suspicious certificate requests, issuance, or DCSync attempts.

This exploit highlights a common theme in advanced persistent threats: chaining multiple legitimate functionalities or misconfigurations to achieve a critical outcome, rather than relying on a single zero-day CVE.

Actionable Mitigations: How to Prevent Certighost Domain Controller Impersonation

Defenders must prioritize hardening Active Directory and Certificate Services configurations to thwart Certighost and similar attacks. A multi-layered approach is essential:

• Secure Certificate Templates:
  • Review all certificate templates, especially those configured for Domain Controller Authentication or Kerberos Authentication.
  • Ensure that only highly privileged, explicitly authorized security groups or accounts can enroll for these certificates. Follow the principle of least privilege.
  • Avoid ‘Enroll’ permissions for ‘Authenticated Users’ or ‘Domain Users’ on sensitive templates.
• Harden Certificate Authority (CA) Servers:
  • Restrict administrative access to CA servers to the absolute minimum necessary personnel.
  • Ensure CA servers are patched, configured securely, and isolated from less trusted network segments.
• Implement Robust Logging and Monitoring:
  • Monitor for suspicious certificate enrollment requests, particularly those for Domain Controller templates.
  • Deploy SIEM solutions to alert on anomalous activity related to AD CS and Active Directory. Specifically look for unusual DCSync activity originating from non-Domain Controller accounts.
  • Focus on Event ID 4768 (Kerberos Authentication Ticket Request) and Event ID 4769 (Kerberos Service Ticket Request) for anomalies.
• Enforce Least Privilege in Active Directory:
  • Regularly audit user and group permissions throughout the AD environment.
  • Ensure that no ordinary user accounts possess unintended administrative or highly sensitive privileges.
• Multi-Factor Authentication (MFA): Implement MFA for all administrative accounts, and ideally for all users, to reduce the impact of compromised credentials.
• Proactive Threat Hunting: Regularly hunt for signs of compromise, including suspicious Kerberos ticket requests, DCSync attempts, or unusual certificate issuance patterns.

Mitigating DCSync attacks after Active Directory certificate compromise involves not only preventing the initial impersonation but also detecting and responding quickly if an attacker successfully obtains the krbtgt hash. Immediate steps would include resetting the krbtgt password twice (with a full Kerberos cycle in between) and thorough forensic investigation to identify affected systems and remove any persistence mechanisms. Runtime Rebel advises all security teams to review their AD and AD CS configurations immediately in light of the Certighost exploit.