How to use the Abusing Shadow Credentials for Privesc agent skill

What the skill makes the agent do

The skill covers the Shadow Credentials technique. It writes an attacker-controlled public key into the msDS-KeyCredentialLink attribute of a target user or computer object, which requires write permission over that object such as GenericWrite, GenericAll or AddKeyCredentialLink as shown in BloodHound. The agent then requests a TGT for the target via PKINIT with the matching key and recovers the target's NT hash without resetting the password.

The skill's workflow has eight steps: confirm the write primitive, add a Shadow Credential with pyWhisker, request a TGT via PKINIT, recover the NT hash, use Certipy's shadow auto as a one-shot alternative, use the recovered credential with NetExec, optionally chain a computer takeover into RBCD, and clean up the injected key. It also includes a Python wrapper script, scripts/agent.py, that runs Certipy and parses its output.

Install the skill

Download the ZIP for this skill from the directory page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

The skill folder should contain SKILL.md, scripts/agent.py, and references/api-reference.md and references/standards.md. Keep the folder structure intact so the agent can find the reference files.

Install the attack tooling the skill expects

The skill's setup section lists the tools it relies on. Install them on a Linux attack host with Python 3.8 or later. The source gives these commands for pyWhisker, Certipy and PKINITtools:

• pyWhisker is cloned from ShutdownRepo and installed with pip from its folder
• Certipy is installed with pipx as certipy-ad
• PKINITtools is cloned from dirkjanm
• NetExec (nxc) is needed for the pass-the-hash steps

How to trigger the skill with natural requests

You do not need to type the skill name. Describe the situation in plain terms that match the skill's description. Useful triggers include BloodHound showing GenericWrite, GenericAll or AddKeyCredentialLink over a target, a wish to take over an account without a password reset, or a request to recover an NT hash through PKINIT during an authorized engagement.

Include the scope and what you already have, such as the domain, a controlled account, and the target name. The skill is written for an authorized engagement, so say so in the request.

• Example: "BloodHound shows my controlled user has GenericWrite over svc-backup. We have written authorization. Walk me through a Shadow Credentials takeover."
• Example: "Check whether I can write msDS-KeyCredentialLink on WS01$ and, if so, recover its NT hash with Certipy."
• Example: "Use the abusing-shadow-credentials-for-privesc skill to clean up the Key Credential I added to the victim account."

What you need before you start

The source lists these requirements. You need Python 3.8 or later, pipx with certipy-ad, pyWhisker, PKINITtools, and NetExec. The domain needs a Domain Controller running Windows Server 2016 or later with PKINIT support. You also need valid credentials for an account that has write access to the target's msDS-KeyCredentialLink, and network reach to LDAP (389 or 636) and Kerberos (88) on a DC.

Safety notes: scripts and network access

The skill runs scripts and uses the network. scripts/agent.py runs Certipy and parses its output, and the workflow sends LDAP and Kerberos traffic to a domain controller. Read the script before running it, and run it only against systems in your written scope.

The skill itself says that Shadow Credentials grant full takeover of the targeted account and that unauthorized access is a crime. The skill is an offensive playbook, not a defensive guide, so it does not give hardening or detection steps. Its cleanup step removes the key you added, which reduces footprint but does not replace reporting.

Tips for better results

Give the agent BloodHound findings first, since the skill is triggered by the ACL path and confirms write access in step one. Ask for the Key Credential list before the add step so you can confirm the primitive. Record the device ID printed during the add, because the remove step needs it. For computer accounts, Certipy's shadow auto takes the sAMAccountName with a trailing $.