DLLPasswordFilterImplant icon indicating copy to clipboard operation
DLLPasswordFilterImplant copied to clipboard

lead to crash when i'm in the workgroup

Open cldog opened this issue 4 years ago • 1 comments

hello when the computer in the workgroup ,after the installing, i change the pass and the system crash... Is this tool only applicable to windows ad domain?

cldog avatar Feb 26 '20 06:02 cldog

Hi @cldog, the DLL was only tested on AD domain controllers, but because of the way that password filters work, it should work for local computers as well. Can you give more details about how you configured it? Make sure you put a valid public key and exfiltration domain in the registry and that you are using the right bitness (32 or 64 depending on target system). If that still doesn't work, you can try building the DLL in debug mode and seeing the output of the log file in C:\Windows\Temp\logFile.txt. You can also compile the PoC project to run the password filter manually, allowing you to debug and test the behavior before it's used as an implant.

I hope this helps.

alxbl avatar Feb 26 '20 13:02 alxbl