Active Directory Certificate Services Chase Mechanism Elevation of Privilege (Certighost)

#Requires -RunAsAdministrator
<#
  Check-Certighost.ps1
  Checks for CVE-2026-54121 (Certighost) exposure on AD CS Enterprise CAs.
  Output: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Step 1: Check if Certification Authority role is installed
try {
    $caRole = Get-WindowsFeature -Name ADCS-Cert-Authority -ErrorAction SilentlyContinue
    if (-not $caRole -or -not $caRole.Installed) {
        Write-Host "[INFO] AD CS Certification Authority role is NOT installed on this host."
        Write-Host "PATCHED"  # Not applicable - no CA role
        exit 0
    }
    Write-Host "[CHECK] AD CS Certification Authority role is INSTALLED."
} catch {
    Write-Host "[WARN] Could not determine CA role status: $_"
    Write-Host "UNKNOWN"
    exit 2
}

# Step 2: Check EditFlags for EDITF_ENABLECHASECLIENTDC (0x00000100, bit 8)
try {
    $rawFlags = certutil -getreg policy\EditFlags 2>&1
    $flagLine = $rawFlags | Select-String 'REG_DWORD'
    if ($flagLine -match '0x([0-9a-fA-F]+)') {
        $editFlags = [Convert]::ToUInt32($Matches[1], 16)
        $chaseEnabled = ($editFlags -band 0x100) -ne 0
        if ($chaseEnabled) {
            Write-Host "[VULN] EDITF_ENABLECHASECLIENTDC is ENABLED (EditFlags = 0x$($editFlags.ToString('X8'))). Chase mechanism is active."
        } else {
            Write-Host "[OK] EDITF_ENABLECHASECLIENTDC is DISABLED (EditFlags = 0x$($editFlags.ToString('X8'))). Chase mechanism is off."
        }
    } else {
        Write-Host "[WARN] Could not parse EditFlags from certutil output."
        $chaseEnabled = $null
    }
} catch {
    Write-Host "[WARN] Could not read EditFlags: $_"
    $chaseEnabled = $null
}

# Step 3: Check OS build against patched versions
$osBuild = [System.Environment]::OSVersion.Version
$buildNumber = $osBuild.Build
$revisionRaw = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR -ErrorAction SilentlyContinue).UBR
$revision = if ($revisionRaw) { [int]$revisionRaw } else { 0 }

Write-Host "[INFO] OS Build: $($osBuild.Major).$($osBuild.Minor).$buildNumber.$revision"

$patchedBuilds = @{
    14393 = 9339   # Server 2016
    17763 = 9020   # Server 2019
    20348 = 5386   # Server 2022
    26100 = 33158  # Server 2025
}

$osPatched = $false
$osBuildKnown = $false
if ($patchedBuilds.ContainsKey($buildNumber)) {
    $osBuildKnown = $true
    $requiredRev = $patchedBuilds[$buildNumber]
    if ($revision -ge $requiredRev) {
        Write-Host "[OK] OS build $buildNumber.$revision meets or exceeds patched revision $requiredRev."
        $osPatched = $true
    } else {
        Write-Host "[VULN] OS build $buildNumber.$revision is BELOW patched revision $requiredRev."
        $osPatched = $false
    }
} elseif ($buildNumber -lt 14393) {
    # Server 2012 / 2012 R2 — check for 0patch or manual mitigation
    $osBuildKnown = $true
    Write-Host "[WARN] Server 2012/2012 R2 detected. Check for 0patch micropatch or registry mitigation."
    $osPatched = $false
} else {
    Write-Host "[WARN] Unrecognized build number $buildNumber. Manual verification needed."
}

# Step 4: Verdict
if ($chaseEnabled -eq $false) {
    Write-Host "`n=== RESULT ==="
    Write-Host "PATCHED"  # Chase disabled = mitigated regardless of patch level
    Write-Host "(Chase mechanism is disabled. CVE-2026-54121 is mitigated.)"
    exit 0
} elseif ($chaseEnabled -eq $true -and -not $osPatched) {
    Write-Host "`n=== RESULT ==="
    Write-Host "VULNERABLE"
    Write-Host "(Chase mechanism is enabled AND OS is unpatched. Immediate action required.)"
    exit 1
} elseif ($chaseEnabled -eq $true -and $osPatched) {
    Write-Host "`n=== RESULT ==="
    Write-Host "VULNERABLE"
    Write-Host "(OS patch is installed but chase flag is still enabled. Feature gate enforcement is uncertain — verify independently. Disable chase as defense-in-depth.)"
    exit 1
} else {
    Write-Host "`n=== RESULT ==="
    Write-Host "UNKNOWN"
    Write-Host "(Could not determine chase flag status. Manual verification required.)"
    exit 2
}