Closed 1mm0rt41PC closed 2 years ago
Hello, thank you for reaching out. I read this article when it came out and while I find it an interesting attack vector I don't really see a reason why this should be implemented in pypykatz. My concerns are as follows:
wdigest.dll
I'd need to get the offsets. (but if someone has a better approach that makes the offset finding universal pls feel free to let me know) This is a lot of work and I don't see benefits for that.I'll leave this issue open for discussion for a few weeks or so.
No takers so far, so I'm closing this issue
Hello !
there are cases where it is not possible to dump passwords because "Credential Guard" is enabled. Since August 2020, there is a method to "bypass" Credential Guard. (see https://teamhydra.blog/2020/08/25/bypassing-credential-guard/).
It would be useful to be able to dynamically patch lsass via pypykatz. The code allowing the bypass does not seem too complex: https://gist.github.com/N4kedTurtle/8238f64d18932c7184faa2d0af2f1240 Moreover, in the case of RunAsPPL is activated, the operation of this bypass becomes complicated. However, with the addition of
--method handledup
it will be possible to bypass RunAsPPL and thus patch lsass.Best regards