ShadowSpray

ShadowSpray 一款在整个域中进行 Shadow Credentials 喷洒攻击的工具，旨在利用域中其他对象上早已被遗忘的 GenericWrite/GenericAll DACL。 为什么需要这个工具 在很多攻防演练中，我观察到（通过 BloodHound）“Everyone”/“Authenticated Users”/“Domain Users”或其他包含域中几乎所有用户的广泛组，拥有对其他域对象的 GenericWrite/GenericAll DACL。 这些权限可以被滥用来在目标对象上添加 Shadow Credentials，并获取其 TGT 和 NT Hash。...

ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...