Shadow Credentials — захват аккаунтов Active Directory

★ 8.4 · security

abusing-shadow-credentials-for-privesc is a Claude Code skill that automates Active Directory account takeover via the Shadow Credentials technique: writing attacker-controlled public keys to the msDS-KeyCredentialLink attribute using pyWhisker, Whisker, or Certipy, then authenticating via PKINIT to recover the target's NT hash without a password reset. It is designed for scenarios where BloodHound reveals GenericWrite, GenericAll, or AddKeyCredentialLink ACEs over a target user or computer object, and requires a domain controller running Windows Server 2016 or later with PKINIT and Key Trust support. The workflow covers confirming write access, appending a Key Credential, requesting a TGT, extracting the NT hash, and cleaning up the injected credential to restore the object's original state. Intended strictly for authorized red-team engagements and purple-team exercises generating msDS-KeyCredentialLink modification telemetry — as a stealthier alternative to ForceChangePassword that avoids account disruption.