mirror of
https://github.com/BlackSnufkin/CredsHunter
synced 2026-06-11 12:07:26 +00:00
BlackSnufkin
dd3ba9d9bb
Rust implementation of the LSASS credential dump primitive against xhunter1.sys (XIGNCODE3 anti-cheat). Uses command 785 to obtain a PPL-bypassing PROCESS_ALL_ACCESS handle via ObOpenObjectByPointer with AccessMode=KernelMode and no OBJ_KERNEL_HANDLE, then walks LSA crypto material and decrypts the LogonSessionList. Modules: - driver: Xhunter / Session wrappers + MemReader trait - proc: PID lookup + PEB-walk remote module discovery - pe: local PE parsing and pattern scan helpers - lsa: LSA key pattern table + BCrypt key extraction + 3DES - logon: LogonSessionList walker + MSV1_0 offsets - wdigest: WDigest credential list walker (best-effort) - sys: OS build number Affected driver bundled: xhunter1.sys 10.0.10011.16384 SHA-256 e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e
26 lines
614 B
TOML
26 lines
614 B
TOML
[package]
|
|
name = "CredsHunter"
|
|
version = "0.2.0"
|
|
edition = "2021"
|
|
description = "xhunter1.sys BYOVD — LSASS credential dump via PPL-bypassing handle leak (CVE-2026-3609)"
|
|
|
|
[dependencies]
|
|
windows = { version = "0.61", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Security",
|
|
"Win32_Security_Cryptography",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_IO",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Diagnostics_ToolHelp",
|
|
"Win32_System_Diagnostics_Debug",
|
|
"Win32_System_SystemInformation",
|
|
] }
|
|
|
|
[profile.release]
|
|
opt-level = 3
|
|
lto = true
|
|
codegen-units = 1
|
|
panic = "abort"
|
|
strip = true
|