tc4dy/CVE-2026-54121-PoC-Exploit

GitHubRepository PoCExploit

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based exploit framework for CVE-2026-54121, an elevation of privilege vulnerability in Active Directory Certificate Services. It includes code to set up rogue SMB and LDAP servers, request a certificate from a CA with manipulated target parameters, and perform PKINIT authentication to extract a Domain Controller's NT hash, enabling domain takeover.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit for CVE-2026-54121, an AD CS privilege escalation vulnerability. The code implements the disclosed attack: creating a computer account, setting up rogue SMB/LDAP servers to intercept CA verification traffic, requesting a certificate with a manipulated target, and extracting NT hashes via PKINIT. No concealed or materially misrepresented behavior was found. The code's actions are consistent with the documented exploit, and all network connections are directed to operator-supplied targets. The Shodan integration is optional and requires an operator-provided API key. No evidence of data exfiltration to a third party, unrelated payload execution, or hidden persistence was observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPythonPowerShell
Target softwareMicrosoft Active Directory Certificate Services
Attack typesElevation of PrivilegeCertificate ForgeryDomain Controller ImpersonationDCSync
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by setting up rogue infrastructure, manipulating certificate request parameters, and extracting credentials. It is not limited to detection; the --exploit flag triggers the full attack chain, and the --detect flag only marks targets as vulnerable without exploitation.

exploit.py:1282exploit.py:1358-1363README.md:75-76

Requirements

  • Low-privileged domain user credentials (username and password or NTLM hash).README.md:45exploit.py:1488-1490
  • Network access to a Domain Controller and a Certificate Authority server.README.md:65-66exploit.py:1486-1487
  • Ability to run the exploit as root to bind to privileged ports (445, 389).exploit.py:1178-1180

Observed behavior

  • Creates a temporary computer account in the domain via LDAP or SAMR.exploit.py:1057-1113
  • Starts rogue SMB and LDAP servers on the attacker's machine to impersonate a Domain Controller.exploit.py:1344-1349
  • Sends a certificate request to the CA with a manipulated 'cdc' attribute pointing to the attacker's IP, causing the CA to query the rogue server.exploit.py:997-1006
  • Uses the issued certificate to perform PKINIT authentication and extract the target Domain Controller's NT hash from the PAC.exploit.py:882-980
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Shodan API (optional, requires SHODAN_API_KEY)The tool can optionally load targets from Shodan if the operator provides an API key. This is a disclosed feature for target discovery.exploit.py:1209-1228
Network Connection
Operator-supplied Domain Controller and Certificate AuthorityAll exploit traffic (LDAP, SMB, RPC, Kerberos) is directed to the Domain Controller IP and CA IP provided by the operator via command-line arguments.exploit.py:1258-1261exploit.py:1021-1027
File Creation
certighost.log, .pfx, .ccache filesThe tool creates a log file, a certificate file (.pfx), and a Kerberos credential cache file (.ccache) locally as part of the exploit process. These are standard outputs for this type of tool.exploit.py:1191exploit.py:1361-1362exploit.py:911-912
Review boundaries

What the analysis did not establish

  • The evidence includes only the README.md, exploit.py, and requirements.txt files. Other files in the repository (e.g., PowerShell script, stealthcert.py) are not provided, so the full scope of the toolkit cannot be assessed.
  • The artifact's binary files (e.g., 54121.png) were not analyzed, but they are unlikely to affect the classification.
  • The code was not executed; the analysis is based solely on static review of the provided source code.
  • The repository contains 5 other files (including 1 non-text media file) that were not included in the analysis packet. Their content is unknown, but the primary exploit logic is in the provided files.
  • The analysis is static; no dynamic execution was performed to confirm runtime behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1