Shadow Credentials

This technique allows an attacker to take over an AD user or computer account if the attacker can modify the target object's (user or computer account) attribute msDS-KeyCredentialLink and append it with alternate credentials in the form of certificates.

Pre-requisites

  • Domain must have Active Directory Certificate Services and Certificate Authority configured.

  • Domain must have at least one DC running with Windows Server 2016 that supports PKINIT.

Attack example

In this example we notice the following:

MARCUS has the AddKeyCredentialLink privilege over ZPH-SVRMGMT1$

Whisker.exe / Rubeus.exe

Whisker.exe

Can now perform S4U attack with previously obtained ticket:

Test if it worked:

Now you can either PsExec, or we can continue from Kali Linux to remotely dump secrets:

See following for more info for Kerberos for linux:

Kerberos on Linux

Can now remotely dump secrets:

Pywhisker / PKINIT

Pywhisker

We will use pywhisker to add a new credential pair to the AD object:

(pay attention to the outputted files/password, we will use this for the next step)

Dirkjan -> PKINITtools

Now we use gettgtpkinit.py to request a TGT using a PFX file. This uses Kerberos PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption key which we will need for getnthash.py tool:

Now we use getnthash.py to submit a TGS request for the account. This will include with the PAC which in turn contains the NT hash that we can decrypt with the AS-REP key that was used for the specific TGT. This tool requires a TGT resulting from PKINIT to be in ourKRB5CCNAME env variable:

We got a valid NTLM hash for the account!

[+] zsm.local\ZPH-SVRMGMT1$:89d0b5687....ad336a77b8ef2f

Machines dont have remote admin access to themselves -> S4U2Self Abuse

Tooling

Last updated