Post

🚀Our tool keycred for KeyCredentialLinks and Shadow Credential attacks now works with updated domain controllers again! It turns out, Microsoft violated their own specs. Try it out: github.com/RedTeamPente...

RedTeam Pentesting

@redteam-pentesting.de

Originally, Microsoft did not enforce their own specs for validated writes at all and only checked if a KeyCredentialLink is already present. Now they require a CustomKeyInformation field with the "MFA Not Required" flag to be present and the last logon timestamp to be absent.

30/1/26, 12:51 pm0 reposts1 like

RedTeam Pentesting

@redteam-pentesting.de

30 Jan

This is kind of funny because CustomKeyInformation is actually forbidden for validated writes according to Microsoft's specs 🤡 learn.microsoft.com/en-us/opensp...

learn.microsoft.com[MS-ADTS]: msDS-KeyCredentialLinkThe object has class computer (or a subclass of computer). The msDS-KeyCredentialLink value satisfies the following