Certipy vs Whisker
GitHub Stats
About Certipy
Certipy is a Python tool for enumerating and abusing Active Directory Certificate Services (AD CS). It can identify vulnerable certificate templates, request certificates for privilege escalation, perform ESC1-ESC8 attacks, extract CA private keys, and forge certificates. AD CS misconfigurations are among the most impactful attack paths in modern Active Directory environments, and Certipy automates the entire attack chain from enumeration to exploitation.
About Whisker
Whisker is a C# tool for performing the Shadow Credentials attack against Active Directory. The attack exploits the msDS-KeyCredentialLink attribute introduced for Windows Hello for Business, which allows certificate-based authentication via Kerberos PKINIT. By adding a rogue Key Credential entry to a target user or computer's msDS-KeyCredentialLink attribute (which requires write access to the attribute), an attacker can then authenticate as that principal using the corresponding private key, without knowing or changing their password. This is stealthier than traditional credential attacks because it doesn't modify the password or trigger password change events. Whisker generates the key pair, adds the Key Credential to the target, and can be combined with Rubeus to request TGTs using the shadow credential. It's particularly effective when you have GenericWrite or GenericAll permissions over user or computer objects.
Platform Support
Tags
Shared
Certipy only
Whisker only