{"id":18303503,"url":"https://github.com/gosecure/dllpasswordfilterimplant","last_synced_at":"2025-04-05T15:30:57.325Z","repository":{"id":97083380,"uuid":"129262080","full_name":"GoSecure/DLLPasswordFilterImplant","owner":"GoSecure","description":"DLL Password Filter Implant with Exfiltration Capabilities","archived":false,"fork":false,"pushed_at":"2020-02-24T18:15:20.000Z","size":40,"stargazers_count":136,"open_issues_count":6,"forks_count":23,"subscribers_count":37,"default_branch":"master","last_synced_at":"2025-03-21T06:33:24.300Z","etag":null,"topics":["active-directory","credentials","password","pentest"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoSecure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-04-12T14:14:13.000Z","updated_at":"2025-03-21T03:41:19.000Z","dependencies_parsed_at":null,"dependency_job_id":"affe396d-34d9-42a1-9b37-49a7e05b5a99","html_url":"https://github.com/GoSecure/DLLPasswordFilterImplant","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FDLLPasswordFilterImplant","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FDLLPasswordFilterImplant/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FDLLPasswordFilterImplant/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FDLLPasswordFilterImplant/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoSecure","download_url":"https://codeload.github.com/GoSecure/DLLPasswordFilterImplant/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247358435,"owners_count":20926219,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","credentials","password","pentest"],"created_at":"2024-11-05T15:25:52.070Z","updated_at":"2025-04-05T15:30:57.319Z","avatar_url":"https://github.com/GoSecure.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DLLPasswordFilterImplant\n\nDLLPasswordFilterImplant is a custom password filter DLL that allows the capture\nof a user's credentials. Each password change event on a domain will trigger the\nregistered DLL in order to exfiltrate the username and new password value prior\nsuccessfully changing it in the Active Directory (AD).\n\nFor more information about password filters consult the [Microsoft documentation][1].\n\n\n[1]: (https://msdn.microsoft.com/en-us/library/windows/desktop/ms721882(v=vs.85).aspx) \"Password Filter Documentation\"\n\n## Installing\n\n1. To install the password filter on a system:\n* Create the DLL for the targeted architecture. Compile in 32-bit for a 32-bit system and in 64-bit for a 64-bit system.\n* Copy the DLL to the Windows installation directory. (Default folder: \\Windows\\System32)\n* Register the password filter by updating the following registry key:\n    ```\n    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n    ```\n    If the `Notification Packages` subkey exists, add the name of the DLL (\"DLLPasswordFilterImplant\" if you didn't rename it) to the existing value data. Do not overwrite the existing values.\n    If the subkey does not exist, create it and add the name of the DLL (\"DLLPasswordFilterImplant\" if you didn't rename it) to the value data.\n    **NOTE:** Do not include the `.dll` extension when adding the name of the DLL in the `Notification Packages` subkey.\n* Configure the public key to use for encrypting credentials.\n    ```\n    KEY=key.pem\n    # Generate an RSA key and dump its public key. Keep the private key around for decryption\n    openssl genrsa -out $KEY 2048\n\n    # Prepare the Windows registry key entry.\n    echo 'Windows Registry Editor Version 5.00' \u003e addKey.reg\n    echo \u003e\u003e addKey.reg\n    echo '[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa]' \u003e\u003e addKey.reg\n    # If python2 does not exist, use `python` instead.\n    echo \"Key=hex:$(openssl rsa -in $KEY -pubout | sed -E '/^\\-/d' | base64 -d | python2 -c 'import sys; print(\",\".join([\"{:02x}\".format(ord(b)) for b in sys.stdin.read()]))')\" \u003e\u003e addKey.reg\n    ```\n    You can then run `addKey.reg` file to append the raw public key to the registry.\n    Note that using asymmetric encryption significantly increases the size of\n    the data to exfiltrate due to message padding. There are possible\n    improvements to be made to reduce the data overhead.\n\n* Restart the system\n[Source](https://msdn.microsoft.com/en-us/library/windows/desktop/ms721766(v=vs.85).aspx)\n\n2. To register the key and the domain for DNS exfiltration:\n* Go to the following registry key:\n    ```\n    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n    ```\n* Create a string type subkey named \"Domain\". Specify your domain in the value of that subkey. **Your domain must start with a \".\" .** (Example value: \".yourdomain.com\")\n\n## Decrypting\n\nThe encrypted data is padded using OAEP and can be decrypted as follows:\n\n```\n# Convert the stitched hex string to raw bytes.\nxxd -r -p exfiltrated.hex \u003e raw.bin\n\n# Decrypt using the private key.\nopenssl rsautl -decrypt -oaep -inkey $KEY -in raw.bin -out decrypted.txt\n```\n\n## Uninstalling\n\nTo completely remove the password filter of a system:\n* Unregister the password filter by updating the following registry key:\n    ```\n    HKEY_LOCAL_MACHINE SYSTEM\\CurrentControlSet\\Control\\Lsa\n    ```\n    In the Notification Packages subkey remove the name of the DLL of the existing value data. Do not remove other existing values.\n\n* Restart the system\n* In the Windows installation directory (Default folder: \\Windows\\System32), find the password filter DLL (\"DLLPasswordFilterImplant.DLL\" if you didn't rename it) and delete the file.\n\n\n## DNS Exfiltration Server\n\nA simple DNS server to receive the exfiltrated data is provided in `scripts/`.\nRun `pip install -r scripts/requirement.txt`, preferably in a virtual\nenvironment. and then provide it with a .PEM encoded private key and optional\noutput file (defaults to `creds.txt`) where to output the credentials.\n\nCurrently, the DNS server does not support concurrent password changes and\nserves only as a proof of concept. Pull requests adding robustness to the server\nare more than welcome.\n\n\n## Caveats\n\n- Deleting the implant requires to first disable it and then restart Windows.\n\n\n## Compatibility\n\nWorks on:\n* Windows 7 Hosts (x64)\n* Windows 10 Hosts (x64)\n* Windows Server 2008 DCs (x64)\n* Windows Server 2012 DCs (x64)\n* Windows Server 2016 DCs (x64)\n\nThe password filter was tested exclusively on systems listed above.\n\n## Debug\n\nHere are some tool that may help you debug the DLL (if necessary):\n* [Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer)\n* [Dependency Walker](http://www.dependencywalker.com/)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgosecure%2Fdllpasswordfilterimplant","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgosecure%2Fdllpasswordfilterimplant","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgosecure%2Fdllpasswordfilterimplant/lists"}