PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - patched fork A working fork of the proof-of-concept tool for CVE-2026-54121, also known as Certighost. Original research and PoC by @H0j3n and @aniqfakhrul detailed analysis at: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26. This fork fixes the SAN...

ShadowSpray

ShadowSpray A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or...

CVE-2026-54121-Certighost

🛡 AI Security Tool Module CVE-2026-54121: Active Directory Certificate Services Impersonation Certighost Official Security Audit Module for AI Security Tool Ecosystem 🌐 Web Demo • 📚 Project Website • 💬 Community Chat Website Navigation: Home • Updates • Downloads • Modules 🧠 Conceptual Overview...

CVE-2026-54121

CVE-2026-54121 Certighost This is a proof-of-concept tool to demonstrace CVE-2026-54121 a.k.a Certighost. Read here https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 for the detailed analysis. Install dependencies The proof of concept is a self-contained Python script. It requires...

PKINITtools

PKINIT tools This repository contains some utilities for playing with PKINIT and certificates. The tools are built on minikerberos and impacket. Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ Installation These tools are only compatible with...

CVE-2026-26128

CVE-2026-26128 Python tool to exploit Kerberos reflection via Unicode normalization in Windows Active Directory. Based on research by Guillaume André / Synacktiv. Installation These tools are only compatible with Python 3.8+. Clone the repository from GitHub, install the dependencies and you shou...

Metasploit-CVE-2026-54121-Certighost

Metasploit-CVE-2026-54121-Certighost Certighost originally discovered and exploited by h0j3n and Aniq Fakhrul. This repo contains Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. The CA can b...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

Invoke-RunAsWithCert

Invoke-RunAsWithCert A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. Description This cmdlet creates a new logon session with the specified certificate via PKINIT. It is meant to be run on a non domain-joined VM. The cmdlet has two modes...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...

CVE-2022-26923

CVE-2022-26923 – Certifried Exploit AD CS Abuse Automated exploitation of CVE-2022-26923 Certifried , enabling privilege escalation through abuse of Active Directory Certificate Services AD CS, with an automatic fallback to Resource-Based Constrained Delegation RBCD, ultimately dumping the NTLM...

DEBIAN-CVE-2026-109243

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard...

CVE-2026-109243

The FreeRDP application, versions 3.0.0 through 3.31.x , is vulnerable to an incorrect permission assignment (CWE-732) in the soft-smartcard component. Specifically, the crypto_write_pem function fails to apply owner-only permissions to private keys. On multi-user Unix hosts, local attackers can ...

certsync

certsync certsync es una nueva técnica para volcar NTDS de forma remota, pero esta vez sin DRSUAPI : utiliza golden certificate y UnPAC the hash. Funciona en varios pasos: 1. Volcar lista de usuarios, información de CA y CRL desde LDAP 2. Volcar certificado de CA y clave privada 3. Forjar fuera d...

Certifried AD CS Machine Certificate Spoofing (CVE-2022-26923)

Exploits CVE-2022-26923: creates a machine account, clears its SPN, sets dNSHostName to match a domain controller, then enrolls an AD CS Machine template certificate via NTLM web enrollment. The resulting certificate may authenticate as the spoofed DC via PKINIT. !/usr/bin/env python3 -- coding:...

CentOS Linux 7.9 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ciqsa-2026_0688)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260688 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2024-3596. Tenable has extracted the preceding...

Rocky Linux 9.2 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-libs-debuginfo / krb5-pkinit / etc Multiple Vulnerabilities (ciqsa-2026_0439)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260439 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.2. It addresses 74 CVEs: CVE-2008-0947, CVE-2016-3120, CVE-2012-1014,...

Rocky Linux 9.6 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_1422)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261422 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.6. It addresses 80 CVEs: CVE-2009-0845, CVE-2008-0947, CVE-2016-3120, CVE-2024-359...

CentOS Linux 8.5 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / libkadm5 (CENTOS8.5:CLSA-2025:1742662173)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1742662173 advisory. - In MIT Kerberos 5 aka krb5 before 1.22 with incremental propagation, there is an integer overflow for a large update size to resize in...