Whisker-ShadowCredentials
NEW Privilege EscalationPersistenceCredential Access WindowsActiveDirectory
Whisker is a C# tool that manipulates the msDS-KeyCredentialLink attribute to perform the Shadow Credentials attack from a Windows host. `Whisker.exe add` generates a certificate, adds the corresponding key credential to the target object, and prints a ready-to-run Rubeus asktgt PKINIT command to authenticate as the victim and recover its NT hash. It requires GenericWrite/GenericAll over the target and a DC that supports PKINIT (an enterprise CA present). Stealthier than a password reset because the account's password is unchanged. Command Reference: Domain: test.local Domain Controller: dc.test.local Target account: victim