swtornio

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

---

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

swtornio

	# 
	# TO-DO: set |DESTINATIONURL| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	# 
	# Include /etc/apache2/redirect.rules
	#

swtornio

All queries use the TrustedSec CS-Situational-Awareness BOF ldapsearch, not OpenLDAP ldapsearch. Syntax: ldapsearch <filter> [--attributes] [--count] [--scope] [--hostname] [--dn] [--ldaps]. Default scope is subtree, --dn sets the search base, --hostname targets a specific DC.

Domains

Generic	Role
megacorp.com	Local domain
foreign.com	Foreign domain

Machines

swtornio

using System;
using System.IO;
using System.Security.Cryptography;
using System.Runtime.Serialization.Formatters.Binary;

namespace hawktracewsus
{
    class Program
    {
        static void Main()

swtornio

#!/bin/sh
# This script based on linux-vm-tools for Ubuntu 22.02.
# Thanks to https://github.com/Hinara/linux-vm-tools/ to script

# This script is for Ubuntu 22.04 Jammy Jellyfish to download and install XRDP+XORGXRDP via
# source.
#
# Major thanks to: http://c-nergy.be/blog/?p=11336 for the tips.
#

swtornio

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program

swtornio

#!/usr/bin/env python2

import SimpleHTTPServer
import SocketServer
import logging

PORT = 8000

class GetHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):

swtornio

                _   _            _      ____             _    _ 
               | | | | __ _  ___| | __ | __ )  __ _  ___| | _| |
               | |_| |/ _` |/ __| |/ / |  _ \ / _` |/ __| |/ / |
               |  _  | (_| | (__|   <  | |_) | (_| | (__|   <|_|
               |_| |_|\__,_|\___|_|\_\ |____/ \__,_|\___|_|\_(_)
                                                 
                                  A DIY Guide

swtornio

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

1. Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

swtornio

#!/usr/bin/env python3


import argparse
import sys
import json

import logging