mirror of
https://github.com/BlackSnufkin/CredsHunter
synced 2026-06-11 12:07:26 +00:00
BlackSnufkin
dd3ba9d9bb
Rust implementation of the LSASS credential dump primitive against xhunter1.sys (XIGNCODE3 anti-cheat). Uses command 785 to obtain a PPL-bypassing PROCESS_ALL_ACCESS handle via ObOpenObjectByPointer with AccessMode=KernelMode and no OBJ_KERNEL_HANDLE, then walks LSA crypto material and decrypts the LogonSessionList. Modules: - driver: Xhunter / Session wrappers + MemReader trait - proc: PID lookup + PEB-walk remote module discovery - pe: local PE parsing and pattern scan helpers - lsa: LSA key pattern table + BCrypt key extraction + 3DES - logon: LogonSessionList walker + MSV1_0 offsets - wdigest: WDigest credential list walker (best-effort) - sys: OS build number Affected driver bundled: xhunter1.sys 10.0.10011.16384 SHA-256 e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e
157 lines
3.8 KiB
TOML
157 lines
3.8 KiB
TOML
# This file is automatically @generated by Cargo.
|
|
# It is not intended for manual editing.
|
|
version = 4
|
|
|
|
[[package]]
|
|
name = "CredsHunter"
|
|
version = "0.2.0"
|
|
dependencies = [
|
|
"windows",
|
|
]
|
|
|
|
[[package]]
|
|
name = "proc-macro2"
|
|
version = "1.0.106"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
|
dependencies = [
|
|
"unicode-ident",
|
|
]
|
|
|
|
[[package]]
|
|
name = "quote"
|
|
version = "1.0.44"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
|
|
dependencies = [
|
|
"proc-macro2",
|
|
]
|
|
|
|
[[package]]
|
|
name = "syn"
|
|
version = "2.0.116"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "3df424c70518695237746f84cede799c9c58fcb37450d7b23716568cc8bc69cb"
|
|
dependencies = [
|
|
"proc-macro2",
|
|
"quote",
|
|
"unicode-ident",
|
|
]
|
|
|
|
[[package]]
|
|
name = "unicode-ident"
|
|
version = "1.0.24"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
|
|
|
[[package]]
|
|
name = "windows"
|
|
version = "0.61.3"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
|
|
dependencies = [
|
|
"windows-collections",
|
|
"windows-core",
|
|
"windows-future",
|
|
"windows-link",
|
|
"windows-numerics",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-collections"
|
|
version = "0.2.0"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
|
|
dependencies = [
|
|
"windows-core",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-core"
|
|
version = "0.61.2"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
|
|
dependencies = [
|
|
"windows-implement",
|
|
"windows-interface",
|
|
"windows-link",
|
|
"windows-result",
|
|
"windows-strings",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-future"
|
|
version = "0.2.1"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
|
|
dependencies = [
|
|
"windows-core",
|
|
"windows-link",
|
|
"windows-threading",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-implement"
|
|
version = "0.60.2"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
|
|
dependencies = [
|
|
"proc-macro2",
|
|
"quote",
|
|
"syn",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-interface"
|
|
version = "0.59.3"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
|
|
dependencies = [
|
|
"proc-macro2",
|
|
"quote",
|
|
"syn",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-link"
|
|
version = "0.1.3"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
|
|
|
|
[[package]]
|
|
name = "windows-numerics"
|
|
version = "0.2.0"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
|
|
dependencies = [
|
|
"windows-core",
|
|
"windows-link",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-result"
|
|
version = "0.3.4"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
|
|
dependencies = [
|
|
"windows-link",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-strings"
|
|
version = "0.4.2"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
|
|
dependencies = [
|
|
"windows-link",
|
|
]
|
|
|
|
[[package]]
|
|
name = "windows-threading"
|
|
version = "0.1.0"
|
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
|
|
dependencies = [
|
|
"windows-link",
|
|
]
|