LaZagneForensic

LaZagne项目 !!! 描述 LaZagne项目 又回来了 !!! LaZagne 使用一个名为 CryptUnprotectData 的Windows内部函数来解密用户密码。这个API应该在受害者用户会话中调用，否则无法正常工作。如果计算机尚未启动（在离线挂载磁盘上进行分析时），或者我们不想在远程主机上放置二进制文件，则无法检索到任何密码。 LaZagneForensic 是为了解决这个问题而创建的。这项工作主要受 Jean-Michel Picod 和 Elie Bursztein 为 DPAPICK 所做的出色工作，以及 Francesco Picasso 为 Windows...

Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The following has been discovered so far: The infection is spread via...

LaZagneForensic - Decrypt Windows Credentials From Another Host

LaZagne uses an internal Windows API called CryptUnprotectData to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started when the analysis is realized on an offline mounted disk, or if we do not want to drop ...

CVE-2006-0363: Undefined Security Weakness

The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEYCURRENTUSER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated ...