domains / families / security / abusing-shadow-credentials-for-privesc

abusing-shadow-credentials-for-privesc

separate

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

When to use

• When BloodHound reveals `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` over a higher-value user or computer
• As a stealthier alternative to `ForceChangePassword` (no password reset = less disruption/alerting)
• To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)
• During red-team operations needing account takeover without locking out the legitimate user
• For purple-team exercises generating `msDS-KeyCredentialLink` modification telemetry

When not to use

• Unauthorized access
• Systems not owned or explicitly authorized in writing

Skill page

Source