Gauntlith

abusing-shadow-credentials-for-privesc

Unclaimed, from mukul975

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll…

Skill

View source at 54a7988

We couldn't check all of this version, so there's no install button.

Not fully checked35.9k stars54a798831d22 · 54a7988 · pinned 12 Nov 2026
Permanent link

All reviews

No reviews yet

Last 30 days

No reviews in the last 30 days

Only people who installed it with the launcher, with an account older than 7 days, can review. Reviews never change a check status.

Turn on JavaScript to read the reviews.