dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

April 9, 2024—KB5036894 (OS Build 22000.2899)

None None...

August 16, 2022—KB5016693 (OS Build 20348.946) Preview

None None...

The vulnerability of Microsoft’s Windows Remote Credential Guard system allows attackers to circumvent security restrictions and enhance their privileges.

The vulnerability of Microsoft’s Windows Remote Credential Guard security feature is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain increased privileges...

CVE-2022-30150

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability...

CVE-2022-30150

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability...

CVE-2022-30150

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability...

Privilege escalation

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability...

CVE-2022-30150 Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability

...

CVE-2022-30150

Technical details about CVE-2022-30150 (Windows Defender Remote Credential Guard Elevation of Privilege) are not provided in the connected documents. The records include the CVE entry and references but do not specify root cause, affected versions, exploitability, or mitigations within the suppli...

CVE-2022-30150: Improper Authentication

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability...

Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability

...

PT-2022-3137 · Microsoft · Windows Defender Remote Credential Guard +1

Name of the Vulnerable Software and Affected Versions: Windows Defender Remote Credential Guard affected versions not specified Description: The issue is related to insufficient access restrictions in Windows Defender Remote Credential Guard, allowing a remote attacker to bypass security...

Abusing RDP’s Remote Credential Guard with Rubeus PTT

TL;DR Microsoft’s Remote Credential Guard RCG for RDP protects creds if an RDP server is compromised. It leaves little scope for password or NTLM credential dumping when a user connects to the server. It does however introduce workstation attack vectors. Abusing a user’s Kerberos token allows...