abusing-shadow-credentials-for-privesc 54a798831d22

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll…

View source at 54a7988

We couldn't check all of this version, so there's no install button.

Not fully checked54a798831d22 · 54a7988 · pinned 12 Nov 2026

Commit

54a798831d2266a3ca61ce68a7acb80b81160d57Source at 54a7988

Works with

Claude Code, SKILL.md

Checks

Instructions read in full
Static code checks
Copy check

Not checked: Sandbox run: not built yet

We couldn't check all of it, for example a file too big to read. No install button.

This version's file list isn't published.