Advanced Active Directory Persistence: Shadow Credentials and Golden Certificates

While Golden and Silver Tickets remain classic Active Directory persistence methods, modern red teams leverage newer techniques like Shadow Credentials and Golden Certificates that abuse Active Directory Certificate Services (AD CS).

Shadow Credentials exploit the msDS-KeyCredentialLink attribute on user and computer objects. If an attacker has write permissions over a target account, they can generate a public-private keypair, append the public key to this attribute, and use PKINIT to request a Ticket Granting Ticket (TGT) without knowing the account's password. This technique is highly stealthy and bypasses traditional password resets.

AD CS template configuration flaws can allow users to request arbitrary certificates. The most severe misconfiguration is the ESC1 vulnerability, where a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled. This allows any authenticated user to request a certificate and manually specify the Subject Alternative Name (SAN), allowing them to impersonate Domain Administrators.

Using tools like Certify, attackers query AD CS templates for misconfigurations:

Certify.exe find /vulnerable

Upon identifying a vulnerable template, they request a certificate masquerading as a Domain Administrator:

Certify.exe request /ca:CA01\cic-CA /template:UserESC1 /altname:administrator

The PEM/PFX certificate returned is then loaded into Rubeus to request a TGT:

Rubeus.exe asktgt /user:administrator /certificate:admin.pfx /password:SecretPass /ptt

This injects a Domain Admin Kerberos ticket directly into memory, completing the escalation.