H0j3n

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

---

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

ThePirateWhoSmellsOfSunflowers

#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies 
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.

nullenc0de

from datetime import datetime
import xml.etree.ElementTree as ET
from typing import List, Dict, Optional
import os
import re
from impacket.dcerpc.v5.dcom.wmi import WBEMSTATUS
from nxc.helpers.logger import highlight

class TaskVulnerability:
    def __init__(self, name: str, path: str, command: str, author: str, 

nullenc0de

from datetime import datetime
from typing import List, Dict
import re
from nxc.helpers.logger import highlight
from concurrent.futures import ThreadPoolExecutor, as_completed
import json

class NXCModule:
    name = "sensitive_search"
    description = "Search for files containing sensitive data patterns in shares with custom regex support"

Chenx221

Visual Studio 2026

https://c2rsetup.officeapps.live.com/c2r/downloadVS.aspx?sku=community&channel=Stable&version=VS18

https://c2rsetup.officeapps.live.com/c2r/downloadVS.aspx?sku=enterprise&channel=Stable&version=VS18

https://c2rsetup.officeapps.live.com/c2r/downloadVS.aspx?sku=professional&channel=Stable&version=VS18

https://aka.ms/vs/18/Stable/vs_community.exe

mpgn

Jab vs NetExec

• Original writeup: https://0xdf.gitlab.io/2024/06/29/htb-jab.html
• Video writeup: https://www.youtube.com/watch?v=tprP-GDW_6c

This writeup only highlights some part of the writeup of @0xdf that can be done with netexec instead of using another tool :)

This is not a full writeup of the JAB machine ! Bug fix on dcom is not fully merge into main !

Thanks to @ippsec for the bug report on mmcexec method !

zhsh9

"""
This script can easily configure /etc/krb5.conf for evil-winrm, by providing a domain fqdn and domain controller name
So that evil-winrm can be used with kerberos authentication

Evil-winrm Example:

```bash
export KRB5CCNAME=Administrator.ccache
evil-winrm -i forest.htb.local -r htb.local
```

testanull

# -*- coding: utf-8 -*-
import hashlib
import base64
import requests, string, struct, uuid, random, re
import sys
from collections import OrderedDict
from sys import version
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯

jonny-jhnson

List was compiled by Jonathan Johnson (@jsecurity101) and Carlos Perez (@Carlos_Perez)

Queries are not complete and are meant to be a reference. If you are using them for hunting use a contains within the query language.

• Kerberoasting
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
• Attributes with passwords
• (userpassword=*)

aconite33

import requests
import json
import time
import argparse
import getpass
import os
import sys


def main():