Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

Shadow Credentials → PKINIT → NT hash

Where GenericWrite is held over a target, write a fake KeyCredentialLink (whfb-like) and authenticate via PKINIT to recover the target's NT hash.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: AD CS / KDC supports certificate authentication. Attacker has GenericWrite or GenericAll on a victim with msDS-KeyCredentialLink writable (Server 2016+).

§ Steps

  1. 01
    Principal w/ GenericWrite on victimInitial Access
    T1078— Valid Accounts
  2. 02
    Pivot as victimLateral Movement
    T1550.002— Pass the Hash
  3. 03
    PKINIT auth → TGTLateral Movement
    T1550.003— Pass the Ticket
  4. 04
    UnPAC-the-hashCredential Access
    AD-UNPAC— UnPAC-the-Hash

    Recovers victim NT hash from the PAC_CREDENTIAL_INFO field.

  5. 05
    Write msDS-KeyCredentialLinkCredential Access
    AD-DACL-SHADOWCREDS— Shadow Credentials (msDS-KeyCredentialLink)

    certipy shadow auto -u <me> -p <pw> -account <victim>

§ References

§ Frequently asked

What is the "Shadow Credentials → PKINIT → NT hash" attack path?
Where GenericWrite is held over a target, write a fake KeyCredentialLink (whfb-like) and authenticate via PKINIT to recover the target's NT hash. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Principal w/ GenericWrite on victim (T1078) — a initial access primitive. Assumed environment: AD CS / KDC supports certificate authentication.
What is the final impact of this kill-chain?
The final step lands on Write msDS-KeyCredentialLink (AD-DACL-SHADOWCREDS), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers