Download Toolkit v3.2

Changelog — CVE-2026-54121 Toolset

telnetd — Bash Script

• Replaced trap '' SIGINT with proper cleanup() handler (removes temp files, kills background PIDs, closes fd 3).
• Added CLEANUP_FILES and CLEANUP_PIDS arrays.
• Fixed printf "$fmt" format-string injection in hex_to_bin (now printf '%b').
• Routed all log/status messages to stderr (>&2); exploit output stays on stdout.
• Added -o <file> flag for mass mode to persist successful targets.
• Added validate_input() for username ([a-zA-Z0-9._-]) and port range.
• Updated show_usage with -o.

telnetd — Python Script

• Added log() helper; all status output to stderr, exploit output to stdout.
• Added validate_username() and validate_port().
• Added parse_int() / parse_float() for safe CLI argument parsing.
• Narrowed except: to except OSError / except (OSError, ValueError).
• Fixed socket leak in _connect_socket on failed connect.
• Added thread cap: min(max_threads, len(targets), 500).
• Added -o <file> flag for mass mode.
• Wrapped worker in try/except to prevent full scan abort.
• Added sys.stdout.flush() after banner.

exploit.py (Full Framework)

• Added _sanitize_argv() to mask credentials in process listing.
• Added --password-file, --hashes-file, --computer-pass-file, --computer-hash-file.
• Added env var support: CERTIGHOST_PASSWORD, CERTIGHOST_HASHES.
• Changed default mode to --detect; --exploit is now opt-in.
• Rewrote detect_ip() to use TCP connect first, UDP fallback, rejects loopback.
• Made check_requirements() non-fatal at import; added enforce_requirements().
• Fixed DCSync subprocess: shutil.which check, returncode / stderr handling.
• Made _setup_logger() idempotent (if not logger.handlers, propagate=False).
• Moved _print_progress() under lock (_print_progress_locked).
• Added _norm_bytes() to fix SID/GUID encoding issues.
• Added _validate_inputs() for domain, username, hash, IP, threads.
• Replaced datetime.utcnow() with datetime.now(timezone.utc).
• Narrowed except: blocks.

stealthcert.py (Minimal)

• Fixed Netlogon ParameterControl to 0x800 | 0x20 (E-bit) — required for DC-hosted CA.
• Rewrote attacker IP detection: TCP first (445/389/135), UDP fallback, rejects loopback.
• Added rogue server readiness check (_wait_rogue_servers, 15s).
• Added _parse_hashes() with strict 3+ part rejection.
• Added _cleanup_artifacts() called on success, failure, and missing hash.
• Added _norm_bytes() for SID/GUID.
• Wrapped create_computer_samr DCE in try/finally with disconnect().
• Replaced random.choices with secrets.choice for computer name.
• Narrowed except: blocks.
• Added -h, --help flag.
• Fixed --keep-files to only affect cleanup, not exploit path.

PowerShell Wrapper

• Added $ErrorActionPreference = 'Stop' and $PSDefaultParameterValues.
• Added Write-Log helper with levels: Info, Warn, Error, Success, Debug, Raw.
• Added Show-Usage function with full parameter list.
• Added [Alias('h')] for -help.
• Native detection now warns when hashes are supplied (NTLM LDAP bind unsupported in .NET).
• Rewrote Resolve-CaDns to return $null on failure (no misleading $dc_ip fallback).
• Added Contains() + Count guards for LDAP attributes.
• Replaced tuple returns with [PSCustomObject] to avoid PowerShell array-flattening.
• Added Find-PythonInterpreter() (python3 → python → py).
• Added Find-PythonExploitScript() using $PSScriptRoot and CWD.
• Python call now captures output (2>&1), exit code, and returns [PSCustomObject].
• Added if/elseif so -password and -hashes are never passed together.
• Changed default mode to -detect; -exploit opt-in, explicitly forwarded to Python.
• Added Exploited, ExploitExit, Timestamp to JSON output.
• Wrapped Invoke-Main in top-level try/catch with optional stack trace.
• Get-NTHash now disposes MD4 provider in finally

Full Exploit v1.2

Critical Fixes

• NetLogon server-trust account patch added to _patch_smb(). Fixes STATUS_NOLOGON_SERVER_TRUST_ACCOUNT when CA is hosted on a Domain Controller.
• Certificate SAN now uses target DC FQDN (rmd_value) instead of the rogue computer name. Fixes KDC_ERR_CLIENT_NAME_MISMATCH during PKINIT.
• Thread exception handling via _thread_entry wrapper. Silent thread deaths now print full tracebacks to stderr.

Reliability Fixes

• create_computer_ldaps error handling improved. Recognizes entryAlreadyExists, already exists, and 0x2071 to avoid false failures.
• 0x800706BA CA RPC error now prints an explicit diagnostic message (CA callback failure hint).
• DCSync step added after successful PKINIT to automatically retrieve krgtgt hash.

PowerShell Detection Script Fixes

• --target-san → --target-account corrected to match Python backend argument.
• Invoke-Expression removed, replaced with & python3 @ArgList to prevent command injection.
• $url and $list parameters now processed into $TargetCA.
• CA DNS resolution added (Resolve-CaDns); ca_ip now uses the resolved CA address instead of falling back to DC IP.
• BaseDN string concatenation fixed with proper parenthesization.
• CA_DNS field added to JSON output.

Full Exploit

Create .gitignore for Python project

Add common Python and environment files to .gitignore