NativeBypassCredGuard : Bypassing Credential Guard With NTAPI Functions

NativeBypassCredGuard is a specialized tool designed to bypass Microsoft’s Credential Guard, a security feature that protects sensitive credentials like NTLM password hashes and Kerberos tickets using virtualization-based security (VBS).

This tool achieves its objective by patching the WDigest.dll file to enable plaintext credential storage in memory, allowing attackers to retrieve cleartext passwords from the LSASS process memory dump.

How NativeBypassCredGuard Works

The tool operates by identifying a specific byte pattern (“39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?? 00”) in the WDigest.dll file on disk. It then calculates memory addresses and modifies two global variables:

1. g_fParameter_UseLogonCredential: Set to 1 to enable plaintext credential storage.
2. g_IsCredGuardEnabled: Set to 0 to disable Credential Guard.

These changes ensure that credentials are stored in plaintext whenever users log in. The next time the LSASS process is dumped, it may contain these plaintext credentials.

NTAPI Functions Utilized

NativeBypassCredGuard exclusively relies on NTAPI functions exported by ntdll.dll, avoiding user-mode hooks and enhancing stealth. Key NTAPI functions include:

• NtOpenProcessToken & NtAdjustPrivilegesToken: Enable SeDebugPrivilege for process manipulation.
• NtCreateFile & NtReadFile: Access and read the WDigest.dll file.
• NtGetNextProcess & NtQueryInformationProcess: Locate and analyze the LSASS process.
• NtReadVirtualMemory & NtWriteProcessMemory: Read and modify memory values within LSASS.

Additionally, the tool can optionally remap a clean version of ntdll.dll into memory to bypass user-mode hooks, further evading detection.

The tool supports two options:

1. check: Reads current values of the target variables.
2. patch: Modifies the variables to bypass Credential Guard.

Optional remapping of ntdll.dll can be specified with true or omitted for default behavior.

• To check values without remapping: bashNativeBypassCredGuard.exe check
• To patch values with remapping: bashNativeBypassCredGuard.exe patch true
• Designed for 64-bit systems; must be compiled as a 64-bit binary.
• Requires access to LSASS and readable PEB structures.
• May fail if system protections block access or prevent DLL loading.

NativeBypassCredGuard demonstrates how attackers can exploit WDigest’s legacy behavior and bypass modern security mechanisms like Credential Guard.