Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privescnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/abusing-shadow-credentials-for-privescgh skill install mukul975/Anthropic-Cybersecurity-Skills abusing-shadow-credentials-for-privescgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc ~/.claude/skills/abusing-shadow-credentials-for-privesc # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc ~/.agents/skills/abusing-shadow-credentials-for-privesc # Codex, Cursor, Gemini CLI, Copilot, OpenCode