 BlackSnufkin
|
dd3ba9d9bb
|
Initial CredsHunter PoC for CVE-2026-3609
Rust implementation of the LSASS credential dump primitive against
xhunter1.sys (XIGNCODE3 anti-cheat). Uses command 785 to obtain a
PPL-bypassing PROCESS_ALL_ACCESS handle via ObOpenObjectByPointer
with AccessMode=KernelMode and no OBJ_KERNEL_HANDLE, then walks
LSA crypto material and decrypts the LogonSessionList.
Modules:
- driver: Xhunter / Session wrappers + MemReader trait
- proc: PID lookup + PEB-walk remote module discovery
- pe: local PE parsing and pattern scan helpers
- lsa: LSA key pattern table + BCrypt key extraction + 3DES
- logon: LogonSessionList walker + MSV1_0 offsets
- wdigest: WDigest credential list walker (best-effort)
- sys: OS build number
Affected driver bundled:
xhunter1.sys 10.0.10011.16384
SHA-256 e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e
|
2026-05-12 01:38:41 -07:00 |
|