PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials.
PyHook Uses frida to inject it’s dependencies into the target process
| Process | API Call | Description | Progress |
|---|---|---|---|
| mstsc | CredUnPackAuthenticationBufferW | Hooks CredUnPackAuthenticationBufferW from mstsc and outputs username and password | DONE |
| runas | CreateProcessWithLogonW | Hooks CreateProcessWithLogonW from runas and outputs username, password and a domain name. | DONE |
| PowerShell | CreateProcessWithLogonW | Hooks CreateProcessWithLogonW from PowerShell and outputs username, password and a domain name (e.g – Start-Process cmd -Credential X). | DONE |
| cmd | RtlInitUnicodeStringEx | Hooks RtlInitUnicodeStringEx from cmd and outputs data from specific filters (e.g – “-p”, “password” etc). | DONE |
| MobaXterm | CharUpperBuffA | Hooks CharUpperBuffA from MobaXterm and outputs credentials for RDP and SSH logins. | DONE |
| explorer (UAC Prompt) | CredUnPackAuthenticationBufferW | Hooks CredUnPackAuthenticationBufferW from explorer and outputs username, password and a domain name. | DONE |
Demo
Setting a static IP address on your server is a smart move. It ensures your…
Xrdp is an open-source implementation of the Microsoft Remote Desktop Protocol (RDP). It lets you access…
Managing user accounts is one of the most basic system administration tasks on any Linux…
Wine (short for "Wine Is Not an Emulator") is a compatibility layer that lets you run…
KVM (Kernel-based Virtual Machine) is an open-source virtualization technology built into the Linux kernel. It lets…
Ubuntu 20.04 LTS (code name Focal Fossa) was released on April 23, 2020. It is a…