One of the most powerful Red Team/Pentest tools you can have on a physical assessment of a building: The "Do not turn off!" sticker - https://t.co/mBoXYMn9Ll
Finally had a moment to test Winlogon password leaking (a.k.a. notifying) on Windows 11. No big surprise.
And the flow is:
-user enters password
-winlogon loads mpnotify.exe
-mpnotify opens RPC channel
-winlogon sends pass via RPC
-mpnotify forwards to DLL
-DLL stores it on disk