Credential Stealers and GINA Interception

Credential Stealers Overview

• Attackers use malware to steal credentials
• Credentials can be captured during user login
• Stored Windows credentials, like password hashes, can be pilfered
• Keystrokes can be logged to capture passwords as they are typed

GINA Interception (Windows XP)

• GINA Interception is an older yet effective attack method
• It was originally designed for third-party authentication in Windows XP
• Malware authors have exploited this functionality for nefarious purposes
• GINA is implemented in msgina.dll
• msgina.dll is loaded during login by winlogon.exe
• Attackers insert a malicious DLL (e.g., fsgina.dll) between winlogon.exe and msgina.dll
• This creates a man-in-the-middle attack
• The malicious DLL intercepts user credentials before they reach msgina.dll
• This allows the login process to proceed normally
• Windows offers a registry location where third-party DLLs can be found and loaded
• The registry location is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
• Stolen credentials can be logged to a file (%SystemRoot%\system32\drivers\tcpudp.sys) or sent over the network
• fsgina.dll has the ability to capture all user credentials submitted for authentication, log them to disk, or transmit them across a network

Hash Dumping

• Hash dumping is a method for extracting credentials
• Attackers dump hashed passwords rather than stealing plaintext passwords
• The dumped passwords can be cracked offline
• Hashed passwords can be used in a Pass-the-Hash (PTH) attack
• Pwdump and Pass-the-Hash (PSH) Toolkit are tools for hash dumping
• The tools inject a malicious DLL into lsass.exe (Local Security Authority Subsystem Service)
• Once inside lsass.exe, the malware uses undocumented Windows functions
• The functions are used to extract password hashes from the Security Account Manager (SAM)
• Hashes are stored in LM (Lan Manager) and NTLM (New Technology LAN Manager) formats

Pwdump Variant Analysis

• Pwdump programs output the LM and NTLM password hashes of local user accounts
• The hashes are retrieved from the Security Account Manager (SAM)
• The standard pwdump utility uses the DLL lsaext.dll
• Once running, the Pwdump DLL executes inside lsass.exe
• Pwdump uses the GetHash function inside a malicious DLL to extract the hashes
• This extraction uses undocumented Windows function calls
• The Windows function calls allow password hashes to be retrieved in an unencrypted form
• When analyzing pwdump variants, analyzing DLLs is needed to determine how the hash dumping operates
• LoadLibraryA is used to load system DLLs (samsrv.dll, advapi32.dll)
• GetProcAddress is used to find and call key functions
  • SamIConnect connects to the Security Account Manager (SAM)
  • SamrQueryInformationUser retrieves user information
  • SamIGetPrivateData extracts private data (password hashes)

Pass-the-Hash (PSH) Toolkit: whosthere-alt Variant Analysis

• The PSH Toolkit contains programs that dump hashes
• whosthere-alt is the most popular
• whosthere-alt dumps the SAM by injecting a DLL into lsass.exe
• Uses a different set of API functions for injection
• The TestDump function actually performs the hash dumping
• Instead of samsrv.dll, this variant loads secur32.dll
• LsaEnumerateLogonSessions is used to get a list of active logon sessions
• The function provides a list of locally unique identifiers (LUIDs) with user names and domain data
• This list is iterated by the DLL to enumerate distinct accounts

Keystroke Logging

• Keylogging is a method of credential stealing
• Malware records keystrokes to observe data such as usernames and passwords
• Windows malware uses many forms of keylogging
• Keyloggers operate in two main ways

Kernel-Based Keyloggers (Advanced)

• Operate at the kernel level
• Often installed as part of rootkits
• Act as keyboard drivers
• Are difficult to detect
• Can bypass user-space protections like antivirus software

User-Space Keyloggers (More Common)

• Use Windows API functions to log keystrokes
• Two main techniques employed:
  • Hooking uses the Windows API to notify the malware each time a key is pressed via SetWindowsHookEx
  • Polling uses the Windows API to constantly poll the state of the keys via GetAsyncKeyState and GetForegroundWindow functions

Hooking (SetWindowsHookEx)

• Hooking keyloggers leverage the Windows API function SetWindowsHookEx
• This type of keylogger may come packaged as an executable
• May include a DLL file to handle logging that can be mapped into many processes automatically

Polling (GetAsyncKeyState & GetForegroundWindow)

• GetAsyncKeyState checks if a key was recently pressed
• GetForegroundWindow identifies which application has focus (e.g., Notepad, Browser)
• The instructions use a loop to continuously check for key presses
• Calls GetForegroundWindow to log the active window
• Iterates through all keyboard keys
• Calls GetAsyncKeyState to check if a key was pressed
• Checks SHIFT and CAPS LOCK state to log accurately
• Loops continuously, the GetForegroundWindow function is called again to ensure the user is still in the same window

Summary of Credential Stealing Techniques

• GINA Interception
  • Malware inserts a malicious DLL (fsgina.dll) between winlogon.exe and msgina.dll to steal credentials at login
• Hash Dumping
  • Malware extracts hashed passwords from Windows SAM using DLL injection into lsass.exe
• Keystroke Logging
  • Malware records keystrokes using hooking (SetWindowsHookEx) or polling (GetAsyncKeyState)