BlackSnufkin/CredsHunter

GitHubRepository PoCExploitRust

PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Rust-based LSASS credential dump exploit that leverages a PPL-bypassing handle leak (CVE-2026-3609) in the xhunter1.sys kernel driver. It opens the driver, sends command 785 to obtain a kernel-minted PROCESS_ALL_ACCESS handle to lsass.exe, and then uses that handle to read and decrypt NTLM/SHA1 hashes and WDigest plaintext credentials.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (Cargo.toml, README.md, src/main.rs) describe and implement a proof-of-concept exploit for CVE-2026-3609, which leverages a vulnerable kernel driver to dump LSASS credentials. The code performs only the documented credential-dumping behavior. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed in the supplied text evidence.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRust
Target softwareWellbia XIGNCODE3 xhunter1.sysMicrosoft Windows LSASS
Attack typesprivilege escalationcredential dumping
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional exploit. It actively exercises the CVE-2026-3609 vulnerability by sending a specific command to the vulnerable driver to obtain a privileged handle, and then uses that handle to perform a credential dump from the LSASS process. The README explicitly describes it as a 'proof-of-concept' and details the exploitation chain, while the source code in main.rs implements the full attack flow.

README.md:5README.md:7src/main.rs:1-8src/main.rs:38-108

Requirements

  • The vulnerable xhunter1.sys driver must be loaded as a kernel service on the target system.README.md:36-41
  • The attacker must have the ability to execute the compiled CredsHunter.exe binary on the target.README.md:24-30

Observed behavior

  • Opens a handle to the xhunter1.sys driver device via CreateFile.README.md:88
  • Sends a WriteFile command (785) to the driver to obtain a kernel-minted PROCESS_ALL_ACCESS handle to the lsass.exe process, bypassing PPL.README.md:89
  • Uses the obtained handle to read memory from lsass.exe, either via ReadProcessMemory or a driver-side memcpy fallback (command 787).README.md:90
  • Locates and extracts the 3DES encryption key and IV from the remote lsass.exe process.README.md:91
  • Walks the LogonSessionList in lsass.exe memory, decrypts credential blobs, and prints NTLM and SHA1 hashes for active logon sessions.README.md:92
  • Attempts to dump WDigest plaintext credentials from memory.src/main.rs:94-105
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Driver Inclusion
xhunter1.sys (SHA-256: e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e)The repository includes the vulnerable signed driver binary to enable end-to-end reproduction of the exploit, as stated in README.md lines 16-17.README.md:16-17
Credential Dumping Behavior
LSASS credential dump via PPL-bypassing handle leakThe main.rs code opens the vulnerable driver, obtains a handle to lsass.exe, extracts the 3DES key, and dumps NTLM/SHA1 hashes and WDigest plaintexts. This matches the documented exploit behavior.src/main.rs:38-108
Review boundaries

What the analysis did not establish

  • The analysis is based on the provided text files (Cargo.toml, README.md, src/main.rs). The remaining 11 files in the repository, including the core driver interaction logic (driver.rs, lsa.rs, logon.rs, etc.) and the vulnerable binary (xhunter1.sys), were not provided as text and were not analyzed.
  • The evidence packet indicates 'complete_artifact_coverage: false' and 'binary_files_uninspected: 1', confirming that not all repository content was inspected.
  • The binary file xhunter1.sys was not analyzed; only its metadata is reported.
  • 10 additional text files in the repository were not included in the evidence packet and were not reviewed.
  • The review is limited to static analysis of the supplied text content; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1