# Nosferatu | Lsass NTLM Authentication Backdoor

**URL:** <https://onehack.st/t/nosferatu-lsass-ntlm-authentication-backdoor/207352>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, cracking\
**Created:** [November 20, 2021, 11:32am UTC](https://onehack.st/t/nosferatu-lsass-ntlm-authentication-backdoor/207352 "2021-11-20T11:32:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [November 20, 2021, 11:32am UTC](https://onehack.st/t/nosferatu-lsass-ntlm-authentication-backdoor/207352/1 "2021-11-20T11:32:19Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/8/981cf5fdf3981d7104e05aff266902a9d96fa3e1.jpeg)

Lsass NTLM Authentication Backdoor

## How it Works

First, the DLL is injected into the `lsass.exe` process, and will begin hooking authentication WinAPI calls. The targeted function is `MsvpPasswordValidate()`, located in `NtlmShared.dll`. In the pursuit of not being detected, the hooked function will call the original function and allow for the normal flow of authentication. Only after seeing that authentication has failed will the hook swap out the actual NTLM hash with the backdoor hash for comparison.

## Usage

Nosferatu must be compiled as a 64 bit DLL. It must be injected using the a DLL Injector with SeDebugPrivilege.

[![injector](https://github.com/kindtime/nosferatu/raw/master/photos/injector.png)](https://github.com/kindtime/nosferatu/blob/master/photos/injector.png)

You can see it loaded using Procexp:

[![loaded](https://github.com/kindtime/nosferatu/raw/master/photos/loaded.png)](https://github.com/kindtime/nosferatu/blob/master/photos/loaded.png)

Login example using Impacket:

[![auth](https://github.com/kindtime/nosferatu/raw/master/photos/auth.png)](https://github.com/kindtime/nosferatu/blob/master/photos/auth.png)

## Limitations

In an Active Directory environment, authentication via RDP, runas, or the lock screen does not work with the `nosferatu` password. Authentication using SMB, WinRM, and WMI is still possible.

In a non-AD environment, authentication works for all aspects.

## GitHub:

> **[GitHub - kindtime/nosferatu: Windows NTLM Authentication Backdoor](https://github.com/kindtime/nosferatu)**
>
> Windows NTLM Authentication Backdoor