AdverXarial Projects

thc-ImpeXary

Extractor LSASS via physical memory read primitives in vulnerable kernel binary and drivers.

Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities.

This release of impexary uses drivers that have already been publicly disclosed as vulnerable. For best results, impexary is intended to operate with kernel drivers that expose read-memory primitive vulnerabilities and are not blocked during loading or publicly known.

This public release does not include exploits for previously undisclosed drivers.

Instead, the project is designed to be modular and extensible, allowing users to research their own drivers and integrate them by extending the read-memory primitive functions in utils.c.

Internally, we have automated the discovery and exploitation process and maintain several signed kernel drivers with written exploits.

Usage

• Run make to compile the BOFs.

• Load the impexary.cna Aggressor Script into your Script Manager.

• To run impexary, use the command impexary [logonpasswords/wdigest] -prv <provider id>.

You can run the help command in your Beacon console with: help impexary.

beacon> help impexary
Synopsis: impexary [logonpasswords/wdigest] -prv <provider id>
Description:
  Dump credentials from LSASS by using signed kernel drivers to read physical memory.

Examples:
  impexary logonpasswords -prv 1
  impexary wdigest

Windows for Pentesting

These are simply the versions we manually stress tested. Major versions such as 1607 should not have breaking changes across minor build updates.

• Windows Server 2012 R2
  • Version 6.3 (OS Build: 9600)
• Windows Server 2016
  • Version 1607 (OS Build: 14393.693)
• Windows Server 2019
  • Version 1809 (OS Build: 17763.3650)
• Windows 10
  • Version 21H2 (OS Build: 19044.6809)
  • Version 22H2 (OS Build: 19045.6466)
• Windows Server 2022
  • Version 21H2 (OS Build: 20348.587)

Warning

While impexary has been tested thoroughly, you should use discretion if deploying in production. impexary leverages vulnerable kernel drivers. It is possible errors may result in a BSOD.

Thanks To

Teams and Contributor

CONTACT

For more, please contact me at byt3n33dl3@pm.me