EN
ENNA

Impacket vs Whisker

GitHub Stats

15.6k
Stars
935
3.9k
Forks
121
350
Issues
3
8d ago
Updated
1y ago
-
License
MIT
Python
Language
C#

About Impacket

Impacket is a collection of Python classes for working with network protocols, essential for Windows and Active Directory pentesting. It provides low-level programmatic access to protocols like SMB, RDP, and LDAP, enabling the development of custom network tools and exploitation scripts. Impacket's extensive support for protocol manipulation makes it a critical resource for security researchers and penetration testers targeting Windows-based environments.

About Whisker

Whisker is a C# tool for performing the Shadow Credentials attack against Active Directory. The attack exploits the msDS-KeyCredentialLink attribute introduced for Windows Hello for Business, which allows certificate-based authentication via Kerberos PKINIT. By adding a rogue Key Credential entry to a target user or computer's msDS-KeyCredentialLink attribute (which requires write access to the attribute), an attacker can then authenticate as that principal using the corresponding private key, without knowing or changing their password. This is stealthier than traditional credential attacks because it doesn't modify the password or trigger password change events. Whisker generates the key pair, adds the Key Credential to the target, and can be combined with Rubeus to request TGTs using the shadow credential. It's particularly effective when you have GenericWrite or GenericAll permissions over user or computer objects.

Platform Support

๐Ÿงlinux๐ŸŽmacos๐ŸชŸwindows
๐ŸชŸwindows

Tags

Shared

active-directory

Impacket only

smbprotocolwindows

Whisker only

shadow-credentialskerberospkinitpersistencelateral-movement