Bypassing Windows LSASS PPL: Kernel Driver Exploitation Tactics

// Overview of LSASS PPL

Windows introduced Protected Process Light (PPL) to enhance security around the Local Security Authority Subsystem Service (LSASS). LSASS is critical in managing authentication and security policy. PPL ensures that only signed processes can interact with LSASS, complicating credential extraction efforts. This article explores advanced techniques to bypass PPL, specifically through kernel driver exploitation.

// Understanding the Kernel Driver Environment

Kernel drivers operate at a higher privilege level than user-mode processes. This characteristic makes them ideal for attacks that seek to bypass PPL protections. When creating a kernel driver, it’s crucial to ensure that it can execute code without being thwarted by Windows security mechanisms like Kernel Patch Protection (KPP).

Identifying Potential Kernel Drivers

Before proceeding with the exploitation, identify the kernel drivers in your environment. Use the following command:

Get-WindowsDriver -Online | Select-Object -Property Driver, ProviderName, DriverVersion

This command lists all drivers, which can help in selecting a target to manipulate. Look for drivers that are outdated or have known vulnerabilities.

// Building a Kernel Driver for Exploitation

Creating a kernel driver requires a solid understanding of Windows Driver Kit (WDK) and the Windows API. The following simplified structure illustrates a basic kernel driver:

#include <ntddk.h>

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    DriverObject->DriverUnload = UnloadDriver;
    // Initialization code here...
    return STATUS_SUCCESS;
}

VOID UnloadDriver(PDRIVER_OBJECT DriverObject) {
    // Cleanup code here...
}

Key Considerations

• Digital Signatures: Ensure your driver is signed appropriately. Unsigned drivers will be blocked by Windows 10 and later.
• Handle Incorrect Configurations: Misconfigurations can lead to blue screens or system instability. Test in controlled environments before deployment.

// Techniques for LSASS Bypass

Technique 1: Memory Manipulation

One method involves manipulating the memory space of the LSASS process directly. This can be achieved by first obtaining a handle to the LSASS process.

1. Obtain a handle to LSASS: Use the following PowerShell command to get the process ID (PID):

   Get-Process lsass | Select-Object -Property Id

2. Open LSASS Process:

   HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lsass_pid);

Ensure you have the correct access rights to interact with LSASS.

3. Read Memory: Use ReadProcessMemory to extract credentials. This requires tweaking the memory protection settings of LSASS to allow read operations.

Technique 2: Kernel Driver Injection

Injecting your driver into the kernel can provide a means to access LSASS memory without triggering PPL protections. This approach can be risky and has various failure modes.

1. Load the Driver: Use Sc.exe to load your driver:

   sc create MyDriver binPath= "C:\Path\To\MyDriver.sys" type= kernel
   sc start MyDriver

2. Implement Memory Reading: The driver should implement a mechanism to read from LSASS. This can be achieved through using MmCopyVirtualMemory to read LSASS memory safely.

3. Error Handling: Ensure that you handle errors effectively. A failed read might indicate permission issues or an incorrect address space.

Defensive Implications

• PPL Auditing: Monitor for unauthorized changes to PPL settings. Use Event ID 4657 to check for changes in process protection settings.
• Kernel Driver Signing: Enforce driver signing policies to prevent loading of unauthorized drivers. Leverage Windows Defender Device Guard for enforcing this policy.
• Credential Guard: Implement Credential Guard to protect LSASS against memory attacks.

// Checklist for Bypass Attempt

1. Identify kernel drivers in the environment. 2. Create a custom kernel driver with necessary access rights. 3. Implement memory access methods for LSASS. 4. Ensure robust error handling and logging. 5. Test in a controlled environment before deploying on production systems.

// Conclusion

Understanding LSASS PPL bypass techniques through kernel driver exploitation is essential for advanced security assessments. Crafting effective strategies in a controlled setting can lead to valuable insights into your systems' vulnerabilities. The DaemonCore Academy curriculum offers accessible training for those looking to refine their skills without recurring subscriptions. Practice these techniques in a disposable range you own, ensuring a safe and ethical approach to security testing.

--- // FIELDOPS REPORT AUTHORIZED BY: Bruce H. //