DΛΣMӨП

// HackTricks · Windows

Shadow Credentials

Shadow Credentials

Intro

Check the original post for all the information about this technique.[1]

In summary, control of a user’s or computer’s msDS-KeyCredentialLink can let an attacker add a key credential, authenticate as that object with PKINIT, and—when the KDC and account support the necessary flows—use the resulting ticket with S4U2Self/user-to-user to recover the object’s NT hash.[1]

In the post, a method is outlined for setting up public-private key authentication credentials to acquire a unique Service Ticket that includes the target’s NTLM hash. This process involves the encrypted NTLM_SUPPLEMENTAL_CREDENTIAL within the Privilege Attribute Certificate (PAC), which can be decrypted.[1]

Requirements

To apply this technique, certain conditions must be met:[1]

  • A minimum of one Windows Server 2016 Domain Controller is needed.
  • The Domain Controller must have a server authentication digital certificate installed.
  • The directory schema must contain msDS-KeyCredentialLink; a Windows Server 2016 or newer DC and a PKINIT-capable certificate on the KDC are the practical platform requirements described by the research. Verify the domain’s schema/DC mix rather than assuming the domain functional-level label alone decides exploitability.
  • An account with delegated rights to modify the msDS-KeyCredentialLink attribute of the target object is required.

Abuse

The abuse of Key Trust for computer objects encompasses steps beyond obtaining a Ticket Granting Ticket (TGT) and the NTLM hash. The options include:[1]

  1. Creating an RC4 silver ticket to act as privileged users on the intended host.
  2. Using the TGT with S4U2Self for impersonation of privileged users, necessitating alterations to the Service Ticket to add a service class to the service name.

A significant advantage of Key Trust abuse is its limitation to the attacker-generated private key, avoiding delegation to potentially vulnerable accounts and not requiring the creation of a computer account, which could be challenging to remove.[1]

Tools

### Whisker

Whisker uses DSInternals to manipulate msDS-KeyCredentialLink from C#. Whisker and its Python counterpart pyWhisker support adding, listing, removing, and clearing key credentials.[2][4]

Whisker functions include:

  • Add: Generates a key pair and adds a key credential.
  • List: Displays all key credential entries.
  • Remove: Deletes a specified key credential.
  • Clear: Erases all key credentials, potentially disrupting legitimate WHfB usage.
Whisker.exe add /target:computername$ /domain:constoso.local /dc:dc1.contoso.local /path:C:\path\to\file.pfx /password:P@ssword1

pyWhisker

pyWhisker brings the workflow to UNIX-like systems with Impacket and PyDSInternals, including list/add/remove and JSON import/export operations.[4]

python3 pywhisker.py -d "domain.local" -u "user1" -p "complexpassword" --target "user2" --action "list"

ShadowSpray

ShadowSpray enumerates domain objects over which the operator has rights such as GenericWrite/GenericAll, attempts to add key credentials broadly, and includes cleanup/recursive modes. Broad spraying is disruptive and conspicuous; use explicit targets and retain each added DeviceID for precise removal.[3]

References