The goal of this PoC is to leverage the registry key discovered here to load a DLL into Lsass.exe that will allow us to fetch the user's credentials (in any form possible) while effectively bypassing Credential Guard. It is worth mentioning that when Credential Guard is enabled, Lsass.exe hands over credential protection and caching to LsaIso.exe, however, Lsass.exe remains the one responsible for verifying the login user credentials.
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
The initial implementation of no-defender used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
Free < 4.1.2, Pro < 5.1.2
app="Synology DiskStation"
897K+ vulnerable devices!
ZoomEye Dork: app="F5 BIG-IP load balancer"
HUNTER : product.name="F5 BIG-IP"
FOFA : product="f5-BIGIP"
FOFA: icon_hash="1540720428"
Shodan: title:"SysAis"
Shodan: http.html:"SysAis"
ZoomEye: app:"SysAid On-Prem Software"
#!/bin/sh
ZoomEye Dork: app="F5 BIG-IP load balancer"
HUNTER : product.name="F5 BIG-IP"
FOFA : product="f5-BIGIP"
The goal of this PoC is to leverage the registry key discovered here to load a DLL into Lsass.exe that will allow us to fetch the user's credentials (in any form possible) while effectively bypassing Credential Guard. It is worth mentioning that when Credential Guard is enabled, Lsass.exe hands over credential protection and caching to LsaIso.exe, however, Lsass.exe remains the one responsible for verifying the login user credentials.
Netlas: http.body:"plugins/suretriggers"
ZoomEye: app="WordPress SureTriggers Plugin"
Free < 4.1.2, Pro < 5.1.2
FOFA: icon_hash="1540720428"
Shodan: title:"SysAis"
Shodan: http.html:"SysAis"
ZoomEye: app:"SysAid On-Prem Software"
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
The initial implementation of no-defender used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
HUNTER :product.name="SonicWall Secure Mobile Access"
FOFA : product="SONICWALL-Secure-Mobile-Access"
SHODAN : server=="SonicWALL SSL-VPN Web Server"
app="Synology DiskStation"
897K+ vulnerable devices!
