KslKatzBof

KO | EN

gitlite — search

#python #hacktoberfest #ai #typescript #llm #go #android #rust #deep-learning #linux #docker #windows #vue #security

(★ 88)

No description available.

KslKatzBof Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# KslKatzBOF

A Beacon Object File (BOF) in-line LSASS credential extraction from C2 using the KslD.sys BYOVD technique.

This project is based on the blog post:
https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team

## Attribution

This BOF is based on **KslKatz** (**Maximilian Barz**), which itself builds upon two foundational projects:

- **KslDump** – BYOVD physical memory access via KslD.sys (Microsoft Defender's kernel driver)
- **GhostKatz** – BOF-based LSASS extraction through physical memory

Also, the primary source of the vulnerability appears to be **maxkray13** and his project, Defender

## What It Does

Extracts credentials from PPL-protected LSASS without injecting into the process, using only Microsoft-signed components already present on disk:

- **MSV1_0** — NT hashes per logon session
- **WDigest** — Cleartext passwords (when caching is enabled)

## Building

```
make
```

Produces `bin/kslkatzbof.x64.o`.

## Usage

Load the BOF using your preferred BOF loader.

## Disclaimer

For authorized security testing only. Misuse of this tool against systems without explicit permission is illegal.

KslKatzBof

KslKatzBof Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

KslKatzBof

KslKatzBof Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README