New Certighost PoC exploit lets attackers hijack Windows domains

A proof-of-concept exploit dubbed 'Certighost' has been released targeting a vulnerability in Windows Active Directory Certificate Services (AD CS). The exploit allows authenticated attackers to potentially compromise and hijack an entire Windows domain. The release of a public PoC significantly lowers the barrier for threat actors to exploit the vulnerability. AD CS vulnerabilities are considered high-value targets as they can enable full domain compromise. Organizations running Windows domains with AD CS are advised to patch and monitor for exploitation attempts. The vulnerability follows a pattern of similar AD CS attack techniques that have been increasingly targeted in recent years.