# coontzy1/pyshadowspray architecture

> Architecture diagram of the GitHub repository coontzy1/pyshadowspray, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/coontzy1/pyshadowspray
- Repository: https://github.com/coontzy1/pyshadowspray

## Overview

PyShadowSpray is a command-line Active Directory shadow-credential operator. Its principal workflow authenticates to LDAP, discovers or selects accounts, modifies each account’s msDS-KeyCredentialLink, uses the resulting certificate for PKINIT TGT acquisition, and optionally extracts NT hashes; spray mode can reuse compromised credentials recursively. The README also documents standalone list/remove/clear operations, stealth mode, cross-domain spraying, and certificate/credential output. The main command and LDAP/PKINIT modules are sampled; some spray and certificate details are documented but their complete implementation is not shown.

Main entry points: [`PyShadowSpray.py`](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py) (Spray orchestration), [`lib/scripts/pkinit_tools.py`](https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/pkinit_tools.py) (PKINIT TGT), [`lib/ldap.py`](https://github.com/coontzy1/pyshadowspray/blob/main/lib/ldap.py) (LDAP authentication), [`lib/scripts/banner.py`](https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/banner.py) (Banner)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_command["Command workflow"]
  node_cli["CLI orchestration<br/>[PyShadowSpray.py]"]
  node_banner["Banner<br/>[banner.py]"]
  node_spray["Spray orchestration<br/>[PyShadowSpray.py]"]
  node_recursive["Recursive spray<br/>[PyShadowSpray.py]"]
end

subgraph group_directory["Directory operations"]
  node_ldap_auth["LDAP authentication<br/>[ldap.py]"]
  node_account_discovery["Account discovery<br/>[PyShadowSpray.py]"]
  node_credential_ops["Credential operations<br/>[PyShadowSpray.py]"]
end

subgraph group_kerberos["PKINIT recovery"]
  node_pkinit["PKINIT TGT<br/>[pkinit_tools.py]"]
  node_hash_recovery["NT hash recovery<br/>[pkinit_tools.py]"]
end

subgraph group_artifacts["Credential artifacts"]
  node_certificates["Certificate generation<br/>[PyShadowSpray.py]"]
  node_output["Credential output<br/>[PyShadowSpray.py]"]
end

node_operator(("Operator"))
node_ad[("Active Directory")]
node_kdc(("Kerberos KDC"))

node_operator -->|"invokes"| node_cli
node_cli -->|"displays"| node_banner
node_cli -->|"authenticates via"| node_ldap_auth
node_ldap_auth -->|"binds to"| node_ad
node_cli -->|"requests"| node_account_discovery
node_account_discovery -->|"queries"| node_ad
node_cli -->|"dispatches"| node_credential_ops
node_credential_ops -->|"reads/writes"| node_ad
node_cli -->|"dispatches"| node_spray
node_spray -->|"enumerates"| node_account_discovery
node_spray -->|"modifies accounts"| node_credential_ops
node_spray -->|"creates credentials for"| node_certificates
node_spray -->|"requests TGT"| node_pkinit
node_certificates -->|"supplies certificate"| node_pkinit
node_pkinit -->|"requests TGT"| node_kdc
node_pkinit -->|"saves ccache"| node_output
node_spray -->|"requests extraction"| node_hash_recovery
node_hash_recovery -->|"requests ticket"| node_kdc
node_hash_recovery -->|"returns hash"| node_output
node_cli -.->|"enables optionally"| node_recursive
node_recursive -->|"repeats with credentials"| node_spray
node_spray -->|"saves artifacts"| node_output

click node_cli "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_banner "https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/banner.py"
click node_ldap_auth "https://github.com/coontzy1/pyshadowspray/blob/main/lib/ldap.py"
click node_account_discovery "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_credential_ops "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_spray "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_recursive "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_certificates "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"
click node_pkinit "https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/pkinit_tools.py"
click node_hash_recovery "https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/pkinit_tools.py"
click node_output "https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_banner,node_spray,node_recursive toneBlue
class node_ldap_auth,node_account_discovery,node_credential_ops,node_ad toneAmber
class node_pkinit,node_hash_recovery toneMint
class node_certificates,node_output toneRose
class node_operator,node_kdc toneIndigo
```

## Components

### Command workflow

- [CLI orchestration](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`
- [Banner](https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/banner.py): `lib/scripts/banner.py`
- [Spray orchestration](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`
- [Recursive spray](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`

### Directory operations

- [LDAP authentication](https://github.com/coontzy1/pyshadowspray/blob/main/lib/ldap.py): `lib/ldap.py`
- [Account discovery](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`
- [Credential operations](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`

### PKINIT recovery

- [PKINIT TGT](https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/pkinit_tools.py): `lib/scripts/pkinit_tools.py`
- [NT hash recovery](https://github.com/coontzy1/pyshadowspray/blob/main/lib/scripts/pkinit_tools.py): `lib/scripts/pkinit_tools.py`

### Credential artifacts

- [Certificate generation](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`
- [Credential output](https://github.com/coontzy1/pyshadowspray/blob/main/PyShadowSpray.py): `PyShadowSpray.py`

### Other components

- **Operator**
- **Active Directory**
- **Kerberos KDC**

## Connections

- Operator → CLI orchestration: invokes
- CLI orchestration → Banner: displays
- CLI orchestration → LDAP authentication: authenticates via
- LDAP authentication → Active Directory: binds to
- CLI orchestration → Account discovery: requests
- Account discovery → Active Directory: queries
- CLI orchestration → Credential operations: dispatches
- Credential operations → Active Directory: reads/writes
- CLI orchestration → Spray orchestration: dispatches
- Spray orchestration → Account discovery: enumerates
- Spray orchestration → Credential operations: modifies accounts
- Spray orchestration → Certificate generation: creates credentials for
- Spray orchestration → PKINIT TGT: requests TGT
- Certificate generation → PKINIT TGT: supplies certificate
- PKINIT TGT → Kerberos KDC: requests TGT
- PKINIT TGT → Credential output: saves ccache
- Spray orchestration → NT hash recovery: requests extraction
- NT hash recovery → Kerberos KDC: requests ticket
- NT hash recovery → Credential output: returns hash
- CLI orchestration → Recursive spray: enables optionally
- Recursive spray → Spray orchestration: repeats with credentials
- Spray orchestration → Credential output: saves artifacts