abusing-shadow-credentials-for-privesc

By mukul975. Updated August 2, 2026. Categories: System Administration.

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

View repository on GitHub

SKILL.md

The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.