PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials.
PyHook Uses frida to inject it’s dependencies into the target process
| Process | API Call | Description | Progress |
|---|---|---|---|
| mstsc | CredUnPackAuthenticationBufferW | Hooks CredUnPackAuthenticationBufferW from mstsc and outputs username and password | DONE |
| runas | CreateProcessWithLogonW | Hooks CreateProcessWithLogonW from runas and outputs username, password and a domain name. | DONE |
| PowerShell | CreateProcessWithLogonW | Hooks CreateProcessWithLogonW from PowerShell and outputs username, password and a domain name (e.g – Start-Process cmd -Credential X). | DONE |
| cmd | RtlInitUnicodeStringEx | Hooks RtlInitUnicodeStringEx from cmd and outputs data from specific filters (e.g – “-p”, “password” etc). | DONE |
| MobaXterm | CharUpperBuffA | Hooks CharUpperBuffA from MobaXterm and outputs credentials for RDP and SSH logins. | DONE |
| explorer (UAC Prompt) | CredUnPackAuthenticationBufferW | Hooks CredUnPackAuthenticationBufferW from explorer and outputs username, password and a domain name. | DONE |
Demo
Java remains one of the most widely used programming platforms for servers, enterprise applications, Android…
Ubuntu users often download software directly from developer websites instead of using the default app…
Installing Ubuntu 26.04 LTS is only the first step toward building a smooth, secure, and…
What is a Software Supply Chain Attack? A software supply chain attack occurs when a…
When people ask how UDP works, the simplest answer is this: UDP sends data quickly…
Endpoint Detection and Response (EDR) solutions have become a cornerstone of modern cybersecurity, designed to…