Skip to content
Get packs

Abusing Shadow Credentials for Privesc

Walks red-team testers through Active Directory account takeover via msDS-KeyCredentialLink abuse.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

This skill teaches an AI agent how to carry out a specific Active Directory attack called Shadow Credentials. It explains how to add an attacker-controlled key to a target account's key attribute, use that key to get a Kerberos ticket, and recover the account's password hash without resetting the password. It also includes a Python wrapper script that runs the Certipy tool and parses its output. It is an offensive security playbook, not a defensive one.

Great for

  • Authorized penetration testers and red-team operators working on a written engagement
  • Security teams running purple-team exercises who need to generate detection telemetry for msDS-KeyCredentialLink changes
  • Students learning how Active Directory key trust and PKINIT attacks work in a lab

Skip it if

  • Anyone testing systems they do not own or lack written authorization for, since this grants full takeover of the targeted account and is illegal without permission
  • Defenders looking for remediation steps, because the skill focuses on exploitation rather than hardening or detection
  • Users without Active Directory and Linux attack tooling experience, because it assumes familiarity with BloodHound, Kerberos, and NT hashes

Try asking

  • “Walk me through confirming GenericWrite on a target user in our authorized red-team lab using pyWhisker”
  • “Run a Certipy shadow auto attack against computer account WS01$ in our test domain”
  • “Explain how to recover an NT hash via PKINIT after adding a shadow credential”
  • “Help me document the ACL path that made this Shadow Credentials attack possible for the remediation report”
Step-by-step guide: how to use Abusing Shadow Credentials for PrivescInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    abusing-shadow-credentials-for-privesc.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip abusing-shadow-credentials-for-privesc.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip abusing-shadow-credentials-for-privesc.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use against lab or client domains with written scope; the legal notice in SKILL.md should be treated as a hard requirement.
  • Run the cleanup step after testing so the injected Key Credential is removed and the target object is restored.
  • Review scripts/agent.py before running it, since it executes external tools such as certipy and pywhisker against a live domain controller.

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.