Nosferatu is a Lsass NTLM Authentication Backdoor
How It Works
First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted function is MsvpPasswordValidate(), located in NtlmShared.dll. In the pursuit of not being detected, the hooked function will call the original function and allow for the normal flow of authentication. Only after seeing that authentication has failed will the hook swap out the actual NTLM hash with the backdoor hash for comparison.
Nosferatu must be compiled as a 64 bit DLL. It must be injected using the a DLL Injector with SeDebugPrivilege.
You can see it loaded using Procexp:
Login example using Impacket:
In the realm of remote desktop management, evilrdp stands out as a powerful tool designed…
wa-tunnel is an innovative tool designed to tunnel TCP data through two WhatsApp accounts, leveraging…
Deepfake apps are sophisticated tools that utilize advanced AI algorithms, particularly Generative Adversarial Networks (GANs),…
Subdominator is a lightweight and fast tool designed for passive subdomain enumeration, primarily used in…
A critical vulnerability, CVE-2025-29927, has recently been identified in the Next.js ecosystem, allowing attackers to…
The Awesome-Redteam repository is a comprehensive collection of tools and resources designed for red teaming…