{"id":13840945,"url":"https://github.com/eladshamir/Whisker","last_synced_at":"2025-07-11T09:34:01.140Z","repository":{"id":42589756,"uuid":"377591888","full_name":"eladshamir/Whisker","owner":"eladshamir","description":"Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding \"Shadow Credentials\" to the target account.","archived":false,"fork":false,"pushed_at":"2024-11-11T12:54:35.000Z","size":141,"stargazers_count":809,"open_issues_count":2,"forks_count":99,"subscribers_count":10,"default_branch":"main","last_synced_at":"2024-11-11T13:38:59.393Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eladshamir.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-06-16T18:28:35.000Z","updated_at":"2024-11-11T12:54:39.000Z","dependencies_parsed_at":"2022-08-12T10:01:51.956Z","dependency_job_id":"daed02da-cd8c-4fa4-bb0f-61e0fb3b951e","html_url":"https://github.com/eladshamir/Whisker","commit_stats":{"total_commits":17,"total_committers":7,"mean_commits":"2.4285714285714284","dds":0.5882352941176471,"last_synced_commit":"5cd373b37652ecf89d2f9137c5ef23a7b3d084bc"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eladshamir%2FWhisker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eladshamir%2FWhisker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eladshamir%2FWhisker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eladshamir%2FWhisker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eladshamir","download_url":"https://codeload.github.com/eladshamir/Whisker/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225712875,"owners_count":17512506,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:00.064Z","updated_at":"2024-11-21T10:31:01.386Z","avatar_url":"https://github.com/eladshamir.png","language":"C#","funding_links":[],"categories":["C# #","Security","📦 Post-Exploitation \u0026 Persistence"],"sub_categories":["Security Tools"],"readme":"# Whisker\n\nWhisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their `msDS-KeyCredentialLink` attribute, effectively adding \"Shadow Credentials\" to the target account.\n\nThis tool is based on code from [DSInternals](https://github.com/MichaelGrafnetter/DSInternals) by Michael Grafnetter ([@MGrafnetter](https://twitter.com/MGrafnetter)).\n\nFor this attack to succeed, the environment must have a Domain Controller running at least Windows Server 2016, and the Domain Controller must have a server authentication certificate to allow for PKINIT Kerberos authentication.\n\nMore details are available at the post [Shadow Credentials: Abusing Key Trust Account Mapping for Takeover](https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab).\n\n## Usage\n\n![](./assets/usage.png)\n\n### Add a new value to the msDS-KeyCredentialLink attribute of a target object:\n\n - `/target:\u003csamAccountName\u003e`: Required. Set the target name. Computer objects should end with a '$' sign.\n\n - `/domain:\u003cFQDN\u003e`: Optional. Set the target Fully Qualified Domain Name (FQDN). If not provided, will try to resolve the FQDN of the current user.\n\n - `/dc:\u003cIP/HOSTNAME\u003e`: Optional. Set the target Domain Controller (DC). If not provided, will try to target the Primary Domain Controller (PDC).\n\n - `/path:\u003cPATH\u003e`: Optional. Set the path to store the generated self-signed certificate for authentication. If not provided, the certificate will be printed as a Base64 blob.\n  \n - `/password:\u003cPASWORD\u003e`: Optional. Set the password for the stored self-signed certificate. If not provided, a random password will be generated.\n\nExample: `Whisker.exe add /target:computername$ /domain:constoso.local /dc:dc1.contoso.local /path:C:\\path\\to\\file.pfx /password:P@ssword1`\n\n\n### Remove a value from the msDS-KeyCredentialLink attribute of a target object:\n\n - `/target:\u003csamAccountName\u003e`: Required. Set the target name. Computer objects should end with a '$' sign.\n    \n - `/deviceID:\u003cGUID\u003e`: Required. Set the DeviceID of the value to remove from the attribute `msDS-KeyCredentialLink` of the target object. Must be a valid GUID.  \n\n - `/domain:\u003cFQDN\u003e`: Optional. Set the target Fully Qualified Domain Name (FQDN). If not provided, will try to resolve the FQDN of the current user.\n    \n - `/dc:\u003cIP/HOSTNAME\u003e`: Optional. Set the target Domain Controller (DC). If not provided, will try to target the Primary Domain Controller (PDC).\n\nExample: `Whisker.exe remove /target:computername$ /domain:constoso.local /dc:dc1.contoso.local /deviceid:2de4643a-2e0b-438f-a99d-5cb058b3254b`\n\n\n### Clear all the values of the the msDS-KeyCredentialLink attribute of a target object: \n  \n - `/target:\u003csamAccountName\u003e`: Required. Set the target name. Computer objects should end with a '$' sign.\n    \n - `/domain:\u003cFQDN\u003e`: Optional. Set the target Fully Qualified Domain Name (FQDN). If not provided, will try to resolve the FQDN of the current user.\n  \n - `/dc:\u003cIP/HOSTNAME\u003e`: Optional. Set the target Domain Controller (DC). If not provided, will try to target the Primary Domain Controller (PDC).\n\nExample: `Whisker.exe clear /target:computername$ /domain:constoso.local /dc:dc1.contoso.local`\n  \n⚠️ *Warning: Clearing the msDS-KeyCredentialLink attribute of accounts configured for passwordless authentication will cause disruptions.*\n\n\n### List all the values of the the msDS-KeyCredentialLink attribute of a target object:\n  \n - `/target:\u003csamAccountName\u003e`: Required. Set the target name. Computer objects should end with a '$' sign.\n  \n - `/domain:\u003cFQDN\u003e`: Optional. Set the target Fully Qualified Domain Name (FQDN). If not provided, will try to resolve the FQDN of the current user.\n  \n - `/dc:\u003cIP/HOSTNAME\u003e`: Optional. Set the target Domain Controller (DC). If not provided, will try to target the Primary Domain Controller (PDC).\n\nExample: `Whisker.exe list /target:computername$ /domain:constoso.local /dc:dc1.contoso.local`\n\n\n## References\n - https://github.com/MichaelGrafnetter/DSInternals\n - https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feladshamir%2FWhisker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feladshamir%2FWhisker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feladshamir%2FWhisker/lists"}