Gauntlith54a798831d22
Not fully checked54a7988 · pinned 12 Nov 2026No notes for this version.
abusing-shadow-credentials-for-privesc
Unclaimed, from mukul975
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll…
View source at 54a7988
We couldn't check all of this version, so there's no install button.