DOCSEARCHbyAlgolia
Submit Docs

Whisker Documentation

repository·main·Indexed 21 days ago

https://github.com/eladshamir/whisker

A C# command-line tool for performing Shadow Credentials attacks by manipulating the msDS-KeyCredentialLink attribute in Active Directory. It enables account takeover via PKINIT Kerberos authentication through commands to add, remove, clear, and list certificate values for user or computer accounts.

Tokens
885
Snippets
4
Records
5
Agent score
26%

What's inside Whisker

  1. Prerequisites for using Whisker

    main

    For Whisker to successfully manipulate Shadow Credentials, the following environment conditions must be met:

    1. Domain Controller Version: Must be running at least Windows Server 2016.
    2. Authentication Support: The Domain Controller must have a server authentication certificate configured to allow for PKINIT Kerberos authentication.

  2. Clear all msDS-KeyCredentialLink values

    main

    Use the clear command to wipe all values from the msDS-KeyCredentialLink attribute of a target object.

    ⚠️ Warning: Clearing this attribute on accounts configured for passwordless authentication may cause service disruptions.

    Arguments:

    • /target:<samAccountName>: Required. The name of the target account. Computer objects must end with a $.
    • /domain:<FQDN>: Optional. The target FQDN.
    • /dc:<IP/HOSTNAME>: Optional. The target Domain Controller.
    Whisker.exe clear /target:computername$ /domain:constoso.local /dc:dc1.contoso.local

  3. List msDS-KeyCredentialLink values

    main

    Use the list command to view all existing values in the msDS-KeyCredentialLink attribute for a specific target object.

    Arguments:

    • /target:<samAccountName>: Required. The name of the target account. Computer objects must end with a $.
    • /domain:<FQDN>: Optional. The target FQDN.
    • /dc:<IP/HOSTNAME>: Optional. The target Domain Controller.
    Whisker.exe list /target:computername$ /domain:constoso.local /dc:dc1.contoso.local

  4. Remove a specific value from msDS-KeyCredentialLink

    main

    Use the remove command to delete a specific certificate entry from the msDS-KeyCredentialLink attribute of a target object using its DeviceID.

    Arguments:

    • /target:<samAccountName>: Required. The name of the target account. Computer objects must end with a $.
    • /deviceID:<GUID>: Required. The GUID of the specific device/certificate to remove.
    • /domain:<FQDN>: Optional. The target FQDN.
    • /dc:<IP/HOSTNAME>: Optional. The target Domain Controller.
    Whisker.exe remove /target:computername$ /domain:constoso.local /dc:dc1.contoso.local /deviceid:2de4643a-2e0b-438f-a99d-5cb058b3254b

  5. Add Shadow Credentials to a target object

    main

    Use the add command to inject a new self-signed certificate into the msDS-KeyCredentialLink attribute of an Active Directory user or computer account. This allows for authentication via PKINIT.

    Arguments:

    • /target:<samAccountName>: Required. The name of the target account. Computer objects must end with a $ (e.g., computername$).
    • /domain:<FQDN>: Optional. The target Fully Qualified Domain Name. If omitted, the tool attempts to resolve the FQDN of the current user.
    • /dc:<IP/HOSTNAME>: Optional. The target Domain Controller. If omitted, the tool attempts to target the Primary Domain Controller (PDC).
    • /path:<PATH>: Optional. The file path where the generated self-signed certificate (.pfx) will be stored. If omitted, the certificate is printed as a Base64 blob.
    • /password:<PASSWORD>: Optional. The password for the stored certificate. If omitted, a random password is generated.
    Whisker.exe add /target:computername$ /domain:constoso.local /dc:dc1.contoso.local /path:C:\path\to\file.pfx /password:P@ssword1