Locked ShadowSpray: spray Shadow Credentials

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long-forgotten GenericWrite/GenericAll DACLs over other objects in the domain.

Why this tool

In a lot of engagements, I see (in BloodHound) that the group “Everyone” / “Authenticated Users” / “Domain Users” or some other wide group, which contains almost all the users in the domain, has some GenericWrite/GenericAll DACLs over other objects in the domain.

This is the hidden content, please

• Sign In
• or
• Sign Up