Golden SAML

python shimit.py -idp <idp> -pk key.pem -c cert.pem -u user@domain

Forge SAML tokens signed with the IdP signing certificate to authenticate as any user in federated applications.

Run it when you already have the ADFS signing certificate (extracted with mimikatz from the ADFS host or from the AD certificate container) and you want persistent cloud access without touching the directory. With the forged token, you enter as a global admin even if their account has MFA: the IdP only validates the signature.

If the IdP rotates the signing certificate (Azure AD does this automatically with Cloud Kerberos Trust or by policy), the token dies without warning. Do not use it if you only need one-off access: a credential dump is more direct and leaves fewer federation artifacts in the logs.