{"uuid": "7f2f7f2d-b3a3-485e-85f0-588d8997f856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54121", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/190113", "content": "Weekly Purple Team: CertiGhost \u2014 Certificate Forging & PKI Lateral Movement\nhttps://www.reddit.com/r/redteamsec/comments/1vee6m8/weekly_purple_team_certighost_certificate_forging/\n\nDropped a new episode this week covering CertiGhost \u2014 a critical vulnerability in Windows Certificate Services that allows attackers to forge certificates and achieve persistent lateral movement across AD infrastructure without needing credentials. On the red team side, we walk through the full exploitation chain: how to leverage CertiGhost to issue rogue certificates for domain controllers and service accounts, then use those certificates to move laterally and establish persistence across your entire environment. On the blue team side, we break down detection \u2014 what certificate issuance anomalies look like in CA logs, what unusual certificate requests fire, and how to build alerting around PKI exploitation. Covers T1649 and T1550.003 with the full red vs. blue format. Resources:  CertiGhost PoC: https://github.com/aniqfakhrul/CVE-2026-54121 NetExec: https://github.com/Pennyw0rth/NetExec  Video: https://youtu.be/srH-SlkL2tA Happy to discuss the exploitation techniques or answer questions about the tradecraft in the comments.    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/srH-SlkL2tA)   [comments] (https://www.reddit.com/r/redteamsec/comments/1vee6m8/weekly_purple_team_certighost_certificate_forging/)", "creation_timestamp": "2026-09-02T01:00:24.606548Z"}