BlackSnufkin dd3ba9d9bb Initial CredsHunter PoC for CVE-2026-3609 ...

Rust implementation of the LSASS credential dump primitive against
xhunter1.sys (XIGNCODE3 anti-cheat). Uses command 785 to obtain a
PPL-bypassing PROCESS_ALL_ACCESS handle via ObOpenObjectByPointer
with AccessMode=KernelMode and no OBJ_KERNEL_HANDLE, then walks
LSA crypto material and decrypts the LogonSessionList.

Modules:
- driver: Xhunter / Session wrappers + MemReader trait
- proc:   PID lookup + PEB-walk remote module discovery
- pe:     local PE parsing and pattern scan helpers
- lsa:    LSA key pattern table + BCrypt key extraction + 3DES
- logon:  LogonSessionList walker + MSV1_0 offsets
- wdigest: WDigest credential list walker (best-effort)
- sys:    OS build number

Affected driver bundled:
  xhunter1.sys 10.0.10011.16384
  SHA-256 e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e

2026-05-12 01:38:41 -07:00

..

driver.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

logon.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

lsa.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

main.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

pe.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

proc.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

sys.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00

wdigest.rs

Initial CredsHunter PoC for CVE-2026-3609

2026-05-12 01:38:41 -07:00