The post explains the Shadow Credentials attack, which exploits Active Directory Certificate Services (AD CS) to inject custom certificates into a user account, allowing attackers persistent access by modifying the msDS-KeyCredentialLink attribute. It provides details on lab setup, various exploitation methods, and mitigation
Table of contents
Table of ContentsIntroduction to Kerberos AuthenticationPrerequisitesLab SetupExploitationBloodhound – Hunting for Weak PermissionMethod for ExploitationPyWhiskerCertipy-adNTLMRelayxBloodyADMetasploitLdap_shellPost-ExploitationImpacket -psexecEvil-winrmDetection & MitigationDetectionMitigationSort: