Nosferatu is a Lsass NTLM Authentication Backdoor
How It Works
First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted function is MsvpPasswordValidate(), located in NtlmShared.dll. In the pursuit of not being detected, the hooked function will call the original function and allow for the normal flow of authentication. Only after seeing that authentication has failed will the hook swap out the actual NTLM hash with the backdoor hash for comparison.
Nosferatu must be compiled as a 64 bit DLL. It must be injected using the a DLL Injector with SeDebugPrivilege.
You can see it loaded using Procexp:
Login example using Impacket:
PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall…
Network fingerprinting is a critical technique for identifying and analyzing network traffic patterns, particularly in…
"HowToHunt" is a platform designed to assist hunters in improving their skills, planning their expeditions,…
SkyFall-Pack is an advanced infrastructure automation toolkit designed for Command and Control (C2) operations. It…
LummaC2 is a commodity malware designed as an information stealer, targeting browsers, cryptocurrency wallets, and…
RustOwl is an innovative tool designed to enhance the Rust programming experience by visualizing ownership…