Understanding the Shadow Credentials Attack Vector

Oct 11, 2024    #windows   #ldap   #msds-keycredentiallink   #shadow-credentials   #active-directory   #rubeus   #whisker  

Understanding the Shadow Credentials Attack Vector:

The Shadow Credentials attack is an advanced technique that exploits Active Directory’s certificate-based authentication mechanism to compromise user accounts without changing their passwords. This attack leverages the msDS-KeyCredentialLink attribute to add a malicious certificate, allowing an attacker to impersonate the target user stealthily.

To put it simply: If we have the WriteProperty privilege (specifically for the msDS-KeyCredentialLink attribute) over a user or computer object, we can set Shadow Credentials for that object and authenticate as them. You read that right, we can add a certificate-based credential to a user or computer and then authenticate as them. We can also request a Kerberos ticket and use it for pass-the-ticket attacks if needed.

What are Shadow Credentials?

The Shadow Credentials attack exploits a feature in Active Directory called Key Trust Account Mapping. This technique allows an attacker to compromise a user account without changing its password, making it particularly stealthy and difficult to detect.

Key Components of the Shadow Credentials Attack:

  1. Whisker: A tool used to manipulate the msDS-KeyCredentialLink attribute of a user account.
  2. Rubeus: A tool for interacting with Kerberos authentication.

Enumerating Users Susceptible to the Shadow Credentials Attack:

  1. Using PowerView: 
       Get-DomainObjectAcl -Identity "CN=<User Name>,CN=Users,DC=domain,DC=com" -ResolveGUIDs | Where-Object {$_.ActiveDirectoryRights -match "WriteProperty" -and $_.SecurityIdentifier -match "S-1-5-21-.*-500" -and $_.ObjectAceType -eq "00000002-0000-0000-c000-000000000000"}

  1. Using Active Directory PowerShell Module:

       Import-Module ActiveDirectory
   (Get-Acl "AD:CN=<User Name>,CN=Users,DC=domain,DC=com").Access |
   Where-Object {$_.ActiveDirectoryRights -match "WriteProperty" -and $_.IdentityReference -match "Domain Admins" -and $_.ObjectType -eq "00000002-0000-0000-c000-000000000000"}

  2. Using ADSI Edit:

    • A GUI tool for viewing and editing AD objects and their attributes.
    • Connect to the domain
    • Navigate to the user object
    • Right-click and select “Properties”
    • Go to the “Security” tab
    • Click “Advanced”
    • Look for entries with “Write msDS-KeyCredentialLink” permission

  3. Using dsacls Command-Line Tool:

       dsacls "CN=Target User,CN=Users,DC=domain,DC=com" | findstr /i "write.*msDS-KeyCredentialLink"

+Shadow Credentials Attack Process: Step by Step+

0. Pre-requisites for Performing the Shadow Credentials Attack:

1. Initial Access

The attacker starts with some level of access to the domain, typically with privileges to modify user attributes.

2. Whisker Execution

The attacker uses Whisker to add a new “shadow credential” to the target account:

whisker.exe add /target:nbarley /domain:sugarape.local

This command:

3. Certificate Generation and Usage

Whisker creates:

The certificate’s role in this attack:

Instead, the process works like this:

  1. The attacker presents the certificate during the Kerberos authentication process
  2. Active Directory validates the certificate against the one stored in msDS-KeyCredentialLink
  3. If valid, AD issues a Kerberos Ticket Granting Ticket (TGT) for the user

4. Rubeus Exploitation:

The attacker then uses Rubeus to leverage the generated certificate:

Rubeus.exe asktgt /user:nbarley /certificate:[Base64 Certificate] /password:"[Password From Whisker]" /domain:sugarape.local /dc:DC.sugarape.local /getcredentials /show

This command:

5. Credential Extraction:

As a result of this process:

6. Overview of the attack using pywhisker:

Impact of the Shadow Credentials Attack:

Shadow Credentials Attack Mitigation Strategies:

To protect against Shadow Credentials attacks:

  1. Monitor for changes to the msDS-KeyCredentialLink attribute
  2. Implement strong access controls on who can modify user attributes in Active Directory
  3. Use advanced threat detection systems that can identify unusual certificate-based authentication patterns
  4. Regularly audit and review certificate issuance and usage in your environment
  5. Implement the principle of least privilege for Active Directory administrators
  6. Use Protected Users security group for sensitive accounts
  7. Enable and configure Windows Defender Credential Guard
  8. Regularly patch and update domain controllers and Active Directory services
  9. Implement multi-factor authentication (MFA) for all user accounts, especially privileged ones
  10. Consider using Privileged Access Workstations (PAWs) for administrative tasks

Shadow Credentials Attack Detection Methods

  1. Monitor Active Directory Logs: Look for Event ID 4662 with the msDS-KeyCredentialLink attribute being modified.
  2. Use PowerShell Scripts: Develop scripts to regularly check for unexpected changes to the msDS-KeyCredentialLink attribute.
  3. Implement SIEM Rules: Create alerts for unusual certificate-based authentication attempts, especially from unexpected sources.
  4. Network Traffic Analysis: Monitor for unusual Kerberos traffic patterns that might indicate certificate-based authentication abuse.

Conclusion

The Shadow Credentials attack vector demonstrates the evolving complexity of securing modern Active Directory environments. It highlights the importance of looking beyond traditional password-based security and considering certificate-based authentication mechanisms and critical user attributes.

As defenders, staying informed about these advanced techniques is crucial. By understanding attacks like Shadow Credentials, we can better prepare our defenses and protect our organizations from sophisticated threats.

Example of a Shadow Credentials Attack in Action:

Sources:


Next: Understanding .NET Deserialization Exploits: A Deep Dive