RedTeamPentesting has unveiled a new tool, keycred, which offers a robust solution for managing KeyCredentialLinks in Active Directory (AD) environments. The keycred tool is designed to manipulate the msDS-KeyCredentialLink LDAP attribute, enabling users to register, list, and manage KeyCredentialLinks efficiently. As organizations continue to rely on AD for identity management, tools like keycred will play a pivotal role in enhancing both offensive and defensive security strategies. By leveraging its ability to manipulate the msDS-KeyCredentialLink attribute, penetration testers can simulate advanced attack scenarios such as Shadow Credentials. While tools like pyWhisker have been available for manipulation msDS-KeyCredentialLink, keycred distinguishes itself with its comprehensive feature set and strict adherence to compliance standards. This command-line interface (CLI) tool and library implements the KeyCredentialLink structures as defined in section 2.2.20 of the Microsoft Active Directory Technical Specification (MS-ADTS). Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. For instance, attackers can use tools like keycred or similar utilities (e.g., pyWhisker) to add malicious KeyCredentials to vulnerable accounts. It also allows for practical deviations from the specification, making it a valuable resource for penetration testers and system administrators. This technique involves appending alternate credentials (certificates) to a target account’s attributes, potentially enabling account takeover if misconfigurations exist. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Its robust capabilities not only empower red teams but also serve as a valuable resource for blue teams seeking to understand and mitigate potential threats. The release of keycred is a game-changer for Active Directory pentesting and administration. Moreover, its integration with PFX file management tools enhances its usability in scenarios requiring certificate-based authentication. The ability to handle certificates directly within the tool eliminates dependency on external utilities like OpenSSL or certutil35.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Feb 2025 03:20:29 +0000