Listen to this Post
Introduction:
The Windows Local Security Authority (LSA) is the crown jewel of authentication in the Windows ecosystem, responsible for validating logins and enforcing security policies. When adversaries gain administrative privileges, they often leverage Pass-the-Hash (PtH) attacks, using stolen NTLM hashes to authenticate without ever needing the plaintext password. GoGoCreds, a newly emerging Proof-of-Concept tool written in Go, offers a powerful, low-level demonstration of how to manipulate the LSA via direct Windows API calls, providing red teamers and security engineers a transparent view into one of the most persistent post-exploitation techniques in modern enterprise environments.
Learning Objectives:
- Understand the mechanics of Pass-the-Hash (PtH) attacks and the role of the Windows Local Security Authority (LSA) in authentication.
- Learn how to compile and utilize Go-based security tools to interact with Windows APIs for credential manipulation.
- Develop skills to detect, mitigate, and defend against PtH attacks through logging configurations and privilege management.
You Should Know:
- Understanding the Mechanics of Pass-the-Hash and LSA Manipulation
At its core, a Pass-the-Hash attack does not “crack” passwords; it bypasses the need for them entirely. In Windows environments, when a user logs in, the operating system stores a hash of their password—specifically the NTLM hash—in memory within the LSA process (lsass.exe). When a user attempts to access a remote service (like SMB), the system uses this hash to generate a “proof of possession” without exposing the original hash. The PtH attack replicates this process: an attacker with administrative rights extracts the NTLM hash from one machine and injects it into the LSA of another process (or the same machine) to impersonate the user.
GoGoCreds automates this injection. It bypasses traditional tools like Mimikatz (which often triggers endpoint detection) by using a custom Go binary that makes direct calls to the Windows API (such as OpenProcess, VirtualAllocEx, and CreateRemoteThread). The tool targets a “sacrificial process”—a benign Windows process like `notepad.exe` or explorer.exe—and injects the extracted NTLM hash into its LSA context. Once injected, that process can be used to authenticate to network resources as the compromised user.
To perform this manually or to understand the tool’s logic, one can use PowerShell with administrative privileges to extract a hash first (for educational purposes) and then use Windows API calls in C or Go to inject it. Here is a conceptual breakdown of the API sequence used:
OpenProcess: Obtains a handle to the target process (e.g.,notepad.exe) withPROCESS_ALL_ACCESS.VirtualAllocEx: Allocates memory within the target process to store the hash and the code responsible for loading it into LSA.WriteProcessMemory: Writes the NTLM hash and a small payload to the allocated memory.CreateRemoteThread: Initiates a thread in the target process that executes the payload, calling `LsaLogonUser` or similar functions to associate the hash with the session.
- Setting Up the Environment: Compiling and Deploying GoGoCreds
Before executing PtH attacks, proper environment configuration is critical. GoGoCreds requires Go to be installed on the attacker’s machine (or compilation environment) and must be executed on a Windows target with administrative privileges. Below is a step-by-step guide for setting up and compiling the tool.
Step 1: Install Go on the Attacker Machine
- Linux (Compilation Host): `sudo apt update && sudo apt install golang-go`
– Windows (Direct Execution): Download the Go installer from `golang.org` and ensure `go` is in the system PATH. - Verify installation: `go version`
Step 2: Clone the Repository and Compile for Windows
Since the target is Windows, cross-compilation from Linux is standard.git clone https://github.com/Maxwell-Blueteam25/GoGoCreds.git cd GoGoCreds GOOS=windows GOARCH=amd64 go build -o gogocreds.exe main.go
Step 3: Transfer the Binary and Prepare the Environment
– Transfer `gogocreds.exe` to the target Windows machine (e.g., via SMB, web download, or USB).
– Open an Administrative Command Prompt or PowerShell session.
– Ensure Windows Defender or EDR is temporarily disabled in a lab setting (for testing only).
Step 4: Extracting a Hash for Injection
Before using GoGoCreds, a valid NTLM hash must be obtained. In a lab, use `mimikatz` or `sekurlsa::logonpasswords` to extract hashes, or use `reg save` to dump the SAM hive. For demonstration, an extracted hash (e.g., aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c) is required. GoGoCreds expects the hash in the format LM:NTLM.
3. Executing GoGoCreds: Code Analysis and Command Structure
The real value of GoGoCreds lies in its open-source nature, allowing defenders to analyze how an attacker might use Go to bypass traditional security controls. The tool’s logic is concentrated in its `main.go` file, which typically defines the target process ID (PID) and the hash string.
Command Syntax:
.\gogocreds.exe -pid <ProcessID> -hash <NTLM_Hash>
Step-by-Step Execution:
- Identify a Sacrificial Process: Run `tasklist` to find a process running under the target user’s context or a generic system process (e.g., `explorer.exe` or
notepad.exe). Note the PID.
2. Run the Injection:
.\gogocreds.exe -pid 1234 -hash aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c
3. Verify Injection: Use a tool like `Process Hacker` or `Sysinternals Process Monitor` to inspect the target process’s loaded modules and handle list. The LSA-related handles should now reflect the injected user context.
Code Snippet Insight:
A simplified Go snippet demonstrating the injection pattern might look like this:
package main
import (
"syscall"
"unsafe"
)
func injectHash(pid int, hash string) {
kernel32 := syscall.NewLazyDLL("kernel32.dll")
openProcess := kernel32.NewProc("OpenProcess")
virtualAllocEx := kernel32.NewProc("VirtualAllocEx")
writeProcessMemory := kernel32.NewProc("WriteProcessMemory")
createRemoteThread := kernel32.NewProc("CreateRemoteThread")
procHandle, _, _ := openProcess.Call(0x1F0FFF, 0, uintptr(pid))
// Memory allocation and writing logic follows...
}
4. Detection and Mitigation: Hardening Against PtH
Defending against PtH attacks requires a multi-layered approach, focusing on privilege management, logging, and endpoint hardening. GoGoCreds highlights the necessity of these controls because the tool itself does not exploit a vulnerability; it abuses legitimate administrative functions.
Detection Strategies:
- Enable Process Creation Auditing: Configure Group Policy to audit process creation (
Audit Process Creation). Monitor for unusual processes (likenotepad.exe) spawning network connections (Event ID 4688). - Monitor LSASS Access: Use Sysmon (Event ID 10) to detect unauthorized access to
lsass.exe. Legitimate tools like GoGoCreds will generate events showing `OpenProcess` calls on LSASS from non-standard binaries. - EDR Rules: Configure EDR to flag binaries that attempt to allocate memory and create remote threads in `lsass.exe` or other critical processes.
Mitigation Techniques:
- Limit Local Administrator Rights: The most effective defense. If attackers cannot obtain administrative privileges, they cannot inject into LSASS. Implement the principle of least privilege.
- Enable Windows Defender Credential Guard: This feature virtualizes LSASS, protecting it from memory reading and injection attempts. It is the most robust native mitigation.
- Use Protected Process Light (PPL): Configure LSA as a PPL process, which prevents non-PPL processes (like standard Go binaries) from opening a handle with full access.
Windows Commands for Hardening:
- Enable Credential Guard:
Run as Administrator $credGuard = (Get-WmiObject -Class Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesConfigured if ($credGuard -ne 3) { Enable-DeviceGuard -CredentialGuard } - Configure LSA Protection:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d 1 /f
- Cloud and API Security Implications of Credential Reuse
While GoGoCreds focuses on on-premises Windows environments, the concept of credential injection extends to cloud and API security. Modern hybrid environments often use Azure AD (Entra ID) and Active Directory Federation Services (ADFS). PtH attacks can be pivoted to the cloud if an attacker steals the tokens or hashes used for federation.
If an adversary compromises a domain controller and steals the NTLM hash of a user with federated access, they may be able to generate SAML tokens or bypass MFA. Security engineers must ensure that:
– Cloud identities are not tied to high-privilege on-prem accounts.
– Azure AD Seamless Single Sign-On (SSO) hashes are stored similarly to NTLM hashes and must be protected.
– API keys and tokens should be rotated frequently and never stored in LSASS memory.
Linux/Windows Cross-Platform Considerations:
While the tool is Windows-specific, defenders on Linux managing cross-platform environments should monitor for tools like `impacket` (e.g., `psexec.py` or wmiexec.py) that utilize PtH remotely. Commands such as:
impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c DOMAIN/user@target-ip
allow remote execution without the password, mirroring the impact of GoGoCreds.
What Undercode Say:
- Key Takeaway 1: GoGoCreds effectively demystifies Pass-the-Hash attacks by providing a minimalist, open-source Go implementation, making it an excellent educational tool for understanding Windows API calls and LSA internals.
- Key Takeaway 2: The tool underscores the critical importance of privileged access management; the primary mitigation against PtH remains the reduction of administrative accounts and the enforcement of Credential Guard and LSA Protection.
- Key Takeaway 3: From a detection standpoint, security teams must shift focus from signature-based alerts to behavioral analytics—monitoring for cross-process memory allocation and remote thread creation targeting LSASS by non-standard executables.
Prediction:
As Go becomes increasingly popular for red team tooling due to its cross-compilation ease and resistance to simple signature detection, we will see a surge in Go-based post-exploitation frameworks. This evolution will force Microsoft and EDR vendors to enhance their detection heuristics, moving beyond simple API hooking to machine learning-based anomaly detection that understands the “intent” of process interactions. Simultaneously, organizations will likely accelerate their adoption of Credential Guard and TPM-based isolation, rendering local PtH injection attempts obsolete, pushing adversaries toward more sophisticated token theft and cloud identity attacks.
▶️ Related Video (88% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Splog Gogocreds – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
