Shadow Credentials
Before jumping into exploiting Shadow Credentials, I highly recommend reading the article from SpecterOps on shadow credentials.
Prerequisites
There are three prerequisites for this attack to be performed:
The ability to write to the
msDS-KeyCredentialLinkattribute on the target.A DC on the domain must be configured to support PKINIT.
Exploitation
After identifying a user account or machine account where the msDS-KeyCredentialLink attribute can be written to, Whisker can be used to essentially automate the exploitation from a Windows machine:
Following running Whisker, it will provide a Rubeus command that can be executed in order to pull the targets TGT or NTLM hash.
Relaying
Ntlmrelayx also supports exploiting shadow credentials and can be used as follows:
References
Last updated
