CVE-2026-54121

CVE-2026-54121 Certighost This is a proof-of-concept tool to demonstrace CVE-2026-54121 a.k.a Certighost. Read here https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 for the detailed analysis. Install dependencies The proof of concept is a self-contained Python script. It requires...

certsync

certsync certsync es una nueva técnica para volcar NTDS de forma remota, pero esta vez sin DRSUAPI : utiliza golden certificate y UnPAC the hash. Funciona en varios pasos: 1. Volcar lista de usuarios, información de CA y CRL desde LDAP 2. Volcar certificado de CA y clave privada 3. Forjar fuera d...

PassTheCert

PassTheCert Sometimes, Domain Controllers do not support PKINIT. This can be because their certificates do not have the Smart Card Logon EKU. However, several protocols, including LDAP, support Schannel, thus authentication through TLS. We created a small Proof-of-Concept tool that allows...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - patched fork A working fork of the proof-of-concept tool for CVE-2026-54121, also known as Certighost. Original research and PoC by @H0j3n and @aniqfakhrul detailed analysis at: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26. This fork fixes the SAN...

CVE-2022-26923

CVE-2022-26923 – Exploit Certifried Abuso de AD CS Explotación automatizada de CVE-2022-26923 Certifried , permitiendo escalada de privilegios mediante el abuso de Servicios de Certificados de Active Directory AD CS, con un fallback automático a Delegación Restringida Basada en Recursos RBCD, y...

PKINITtools

PKINIT tools This repository contains some utilities for playing with PKINIT and certificates. The tools are built on minikerberos and impacket. Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ Installation These tools are only compatible with...

Masky

Masky Masky es una librería de Python que proporciona una forma alternativa de volcar de forma remota las credenciales de los usuarios del dominio gracias a un ADCS. Se ha construido una herramienta de línea de comandos sobre esta librería para recopilar fácilmente PFX, hashes NT y TGT en un ámbi...

ShadowSpray

ShadowSpray Una herramienta para rociar Shadow Credentials a través de todo un dominio con la esperanza de abusar de DACLs GenericWrite/GenericAll olvidados hace mucho tiempo sobre otros objetos del dominio. Por qué esta herramienta En muchas evaluaciones veo en BloodHound que el grupo "Everyone"...

Metasploit-CVE-2026-54121-Certighost

Metasploit-CVE-2026-54121-Certighost Certighost originally discovered and exploited by h0j3n and Aniq Fakhrul. This repo contains Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. The CA can b...

CVE-2026-54121-Certighost

🛡 AI Security Tool Module CVE-2026-54121: Active Directory Certificate Services Impersonation Certighost Official Security Audit Module for AI Security Tool Ecosystem 🌐 Web Demo • 📚 Project Website • 💬 Community Chat Website Navigation: Home • Updates • Downloads • Modules 🧠 Conceptual Overview...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...

CVE-2026-26128

CVE-2026-26128 Python tool to exploit Kerberos reflection via Unicode normalization in Windows Active Directory. Based on research by Guillaume André / Synacktiv. Installation These tools are only compatible with Python 3.8+. Clone the repository from GitHub, install the dependencies and you shou...

Invoke-RunAsWithCert

Invoke-RunAsWithCert A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. Description This cmdlet creates a new logon session with the specified certificate via PKINIT. It is meant to be run on a non domain-joined VM. The cmdlet has two modes...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1782979178)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782979178 advisory. - In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a...

Rocky Linux 9.2 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-libs-debuginfo / krb5-pkinit / etc (ciqsa-2026_0439)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260439 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-3596. Tenable has extracted the preceding description block...

Rocky Linux 9.6 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_1422)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261422 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-40355, CVE-2026-40356. Tenable has extracted the...

CentOS Linux 7.9 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_0687)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260687 advisory. This advisory aggregates security fixes for the krb5 SRPM in CIQ CentOS Bridge 7.9. It addresses 2 CVEs: CVE-2024-37370, CVE-2024-37371. Tenable has...

CentOS Linux 8.5 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / libkadm5 (CENTOS8.5:CLSA-2025:1742662173)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1742662173 advisory. - In MIT Kerberos 5 aka krb5 before 1.22 with incremental propagation, there is an integer overflow for a large update size to resize in...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ALMALINUX9.2:CLSA-2024:1732195001)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1732195001 advisory. - Kerberos 5 aka krb5 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. CVE-2024-26462 Note that Nessus has not tested for...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1733141074)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1733141074 advisory. - Kerberos 5 aka krb5 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c. CVE-2024-26458 - Kerberos 5 aka krb5 1.21.2...