How coontzy1/pyshadowspray works
PyShadowSpray is a command-line Active Directory shadow-credential operator. Its principal workflow authenticates to LDAP, discovers or selects accounts, modifies each account’s msDS-KeyCredentialLink, uses the resulting certificate for PKINIT TGT acquisition, and optionally extracts NT hashes; spray mode can reuse compromised credentials recursively. The README also documents standalone list/remove/clear operations, stealth mode, cross-domain spraying, and certificate/credential output. The main command and LDAP/PKINIT modules are sampled; some spray and certificate details are documented but their complete implementation is not shown.
Main entry points: PyShadowSpray.py Spray orchestration · pkinit_tools.py PKINIT TGT · ldap.py LDAP authentication · banner.py Banner
Components 14
Command workflow
- CLI orchestration
PyShadowSpray.py - Banner
lib/scripts/banner.py - Spray orchestration
PyShadowSpray.py - Recursive spray
PyShadowSpray.py
Directory operations
- LDAP authentication
lib/ldap.py - Account discovery
PyShadowSpray.py - Credential operations
PyShadowSpray.py
PKINIT recovery
- PKINIT TGT
lib/scripts/pkinit_tools.py - NT hash recovery
lib/scripts/pkinit_tools.py
Credential artifacts
- Certificate generation
PyShadowSpray.py - Credential output
PyShadowSpray.py
Other components
- Operator
- Active Directory
- Kerberos KDC
Connections 22
- Operator → CLI orchestration: invokes
- CLI orchestration → Banner: displays
- CLI orchestration → LDAP authentication: authenticates via
- LDAP authentication → Active Directory: binds to
- CLI orchestration → Account discovery: requests
- Account discovery → Active Directory: queries
- CLI orchestration → Credential operations: dispatches
- Credential operations → Active Directory: reads/writes
- CLI orchestration → Spray orchestration: dispatches
- Spray orchestration → Account discovery: enumerates
- Spray orchestration → Credential operations: modifies accounts
- Spray orchestration → Certificate generation: creates credentials for
- Spray orchestration → PKINIT TGT: requests TGT
- Certificate generation → PKINIT TGT: supplies certificate
- PKINIT TGT → Kerberos KDC: requests TGT
- PKINIT TGT → Credential output: saves ccache
- Spray orchestration → NT hash recovery: requests extraction
- NT hash recovery → Kerberos KDC: requests ticket
- NT hash recovery → Credential output: returns hash
- CLI orchestration → Recursive spray: enables optionally
- Recursive spray → Spray orchestration: repeats with credentials
- Spray orchestration → Credential output: saves artifacts