Shadow Credentials
Overview
This technique allows an attacker to take over an AD user or computer account if the attacker can modify the target object's (user or computer account) attribute msDS-KeyCredentialLink and append it with alternate credentials in the form of certificates.
Unless you have some rights in the Certerficate authority this attack will only be available in the key trust model.
Key trust
pros
Doesnt require ca to setup
Does use tpm cons
No centralized administration. Keys must be disabled per object
self signed cert (arguably the whole problem with this model)
Pre-requisites
Besides the ability to write the attribute msDS-KeyCredentialLink on a target user or computer, for this technique to work, the environment must be set up as follows:
At least one Windows Server 2016 Domain Controller.
A digital certificate for Server Authentication installed on the Domain Controller.
Windows Server 2016 Functional Level in Active Directory.
Compromise an account with the delegated rights to write to the msDS-KeyCredentialLink attribute of the target object.
Domain must have at least one DC running with Windows Server 2016 that supports PKINIT.
Steps to perform - windows
Steps to perform - Linux
Performing with other tools
AD Auditing
![[Pasted image 20240510073403.png]] This can be used to find orphaned or malicious keys existing in AD.
Also the DSInternals module can find ROCA vulnerable / weak keys in AD
cleaning up a user and device object in ad will affect ALL devices a user has access to (DSInternals allows selective deletion of keys) ![[Pasted image 20240510074200.png]]![[Pasted image 20240510074315.png]]