0x12 Dark Development

Offensive Security

[0x12 Dark Development @papadelospapas_]

Let me check which AV is protecting my data...

[0x12 Dark Development @papadelospapas_]

Secure kernel, the VLT1 kernel uses the same way to work than the regular kernel (VLT0). VTL0 works via syscalls. In VLT1, the syscalls are named Secure Calls.

Usermode -> syscall -> ntoskrnl.exe (VTL0) → HvlpVtlCall → VMCALL → hypervisor → securekernel.exe (VTL1)

[0x12 Dark Development @papadelospapas_]

Microsoft wants EDR vendors to stop shipping their own kernel drivers. Instead, a single MS driver (wesp.sys) collects kernel events and delivers them to the EDR’s usermode service via a filter communication port. The EDR only writes detection rules

https://t.co/Emi5lo6MR1

[0x12 Dark Development @papadelospapas_]

@TinySecEx The issue is that the DLLs need to be Microsoft signed. I may have made a mistake in my testing, as I automated all the checks in a single script, but the MS signed DLLs I tested don't initialize correctly unless they find the expected service name

[0x12 Dark Development @papadelospapas_]

I can load any signed DLL into PPL protected processes.
However, I can’t exploit this because each DLL checks the service name and enters an idle loop on mismatch, without exposing RPC, named pipes, or useful functionality. It’s running as PPL but offers no surface. Any ideas?

[0x12 Dark Development @papadelospapas_]

Just published a reference of every kernel structure, routine, and MSR monitored by PatchGuard (KPP) on Windows.
Some ones may be missing, so PRs are welcome!
https://t.co/VmHU8linsK

[0x12 Dark Development @papadelospapas_]

@ntdebug The ones I found are not working, maybe I need to check in more of them

[0x12 Dark Development @papadelospapas_]

@b33rb4r0n Thank you! Genial

[0x12 Dark Development @papadelospapas_]

Runtime Credential Guard Deactivation

New Medium post, in this one we will see how to bypass Windows Credential Guard at runtime by signaling an undocumented named kernel event inside LsaIso.exe, and then just dump the lsass process and it’s user hashes

https://t.co/XMOtq00h4l

[0x12 Dark Development @papadelospapas_]

any Microsoft signed DLL*

[0x12 Dark Development @papadelospapas_]

@Octoberfest73 Not at all, patching g_IsCredGuardEnabled tricks wdigest into caching plaintext but CG is still running, NT hashes stay in VTL1. This actually shuts LsaIso.exe down, and NT hashes for new sessions land in VTL0

[0x12 Dark Development @papadelospapas_]

Credential Guard Runtime Shutdown
VBS is supposed to keep your NT hashes locked in VTL1 forever. Turns out LsaIso.exe exposes a named event that tears it all down at runtime.
Steal a SYSTEM token, signal it and extract NT hashes straight from LSASS

https://t.co/aBc4Ug2uTV

[0x12 Dark Development @papadelospapas_]

@Octoberfest73 Good question, wdigest toggle gets you plaintext but doesn’t bypass CG; with CG active it also gets blocked at VTL0. This disables CG first so new sessions land in VTL0. They’re complementary, disable CG with this, then layer wdigest on top if you want plaintext

[0x12 Dark Development @papadelospapas_]

Something big is coming to Medium today...

[0x12 Dark Development @papadelospapas_]

Executing shellcode in kernel mode by combining PTE manipulation with the DRIVER_OBJECT of our own vulnerable driver, redirecting the IRP_MJ_DEVICE_CONTROL function pointer to a memory page we control and have configured through PTE manipulation

[0x12 Dark Development @papadelospapas_]

@th4d1g1m0rtal That was because of the debug mode, now are 90 bytes

[0x12 Dark Development @papadelospapas_]

Building a Windows Kernel Shellcode Compiler Inspired by Stardust
This project allows you to write your own C code (with certain limitations) and compile it into shellcode ready to execute in kernel mode. Some restrictions are still in place, and I’m working to address them.

[0x12 Dark Development @papadelospapas_]

Useful option to integrate AI in a C2. Probably better than hardcode a list of process names

[0x12 Dark Development @papadelospapas_]

Local Shellcode Execution via SetupIterateCabinetW

New Medium post, today we are going to explore a shellcode execution technique that abuses SetupIterateCabinet (a Cabinet file enumeration function) to dispatch shellcode through a file callback pointer

https://t.co/ktUCguGPw0

[0x12 Dark Development @papadelospapas_]

Executing Shellcode with SetupIterateCabinetW

Credits:
@0xmrlowlevel