# Shadow Credentials Privesc

Takes over AD accounts via key credentials and recovers NT hashes for testing.

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill abusing-shadow-credentials-for-privesc -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Abusing Shadow Credentials for Privilege Escalation

> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.

## Overview

The **Shadow Credentials** technique abuses the `msDS-KeyCredentialLink` attribute of Active Directory user and computer objects. This attribute stores raw public keys ("Key Credentials") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's `msDS-KeyCredentialLink`, typically granted by `GenericWrite`, `GenericAll`, `WriteProperty`, or `AddKeyCredentialLink` ACEs surfaced in BloodHound, they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover **without resetting the password**, which is far stealthier than a forced password reset.

The technique was published by Elad Shamir (*"Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover"*) and implemented in the C# tool **Whisker**. The Python equivalent **pyWhisker** (ShutdownRepo) manipulates the attribute over LDAP, and **Certipy** integrates the entire chain via `certipy shadow auto`. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: [pyWhisker](https://github.com/ShutdownRepo/pywhisker), [Whisker](https://github.com/eladshamir/Whisker), [The Hacker Recipes, Shadow Credentials](https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials).

## When to Use

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/abusing-shadow-credentials-for-privesc/SKILL.md