Abusing Shadow Credentials For Privesc

Mahipal

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset.

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -a claude-code -g

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -a codex -g

gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/abusing-shadow-credentials-for-privesc

gh skill install mukul975/Anthropic-Cybersecurity-Skills abusing-shadow-credentials-for-privesc

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc ~/.claude/skills/abusing-shadow-credentials-for-privesc   # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc ~/.agents/skills/abusing-shadow-credentials-for-privesc   # Codex, Cursor, Gemini CLI, Copilot, OpenCode

Install

Related