LSA Whisperer

LSA Whisperer is a set of tools for interacting with authentication packages using their individual message protocols. Support is currently provided for the cloudap, kerberos, msv1_0, negotiate, pku2u, and schannel packages and cloudap's AzureAD plugin. Partial or unstable support is provided for livessp, negoexts, and the security package manager (SPM). Please refer to the wiki to see which message protocols are currently supported.

Support for more authentication packages and package calls may be added in the future. If you are interested in a package call that is not implemented or you see an area of the wiki that can be improved, please submit an issue on GitHub or consider making a pull request (PR) for the project. Contributions are appreciated!

Building

LSA Whisperer uses CMake to generate and run the build system files for your platform. The project does not rely on any library manager to allow it to be easily built in an offline environment if desired. You will need the latest Windows 11 SDK, which at the time of this writing is 10.0.22621.0.

git clone --recurse-submodules https://github.com/EvanMcBroom/lsa-whisperer.git
cd lsa-whisperer/builds
cmake .. -A {Win32 | x64}
cmake --build .

By default CMake will build both the lsa-whisperer utility and the sspi static library it uses. The lsa-whisperer utility will be linked against the static version of the runtime library which will allow the tool to run as a standalone program on other hosts.

If Doxygen and the Python modules in the docs/requirements.txt file are installed, then CMake will build the documentation for the sspi static library as well.

Open Source

Thank you to the following packages that are used in LSA Whisperer directly or indirectly:

• Cli

  • AmokHuginnsson/replxx (license - Multiple)
  • jarro2783/cxxopts (license - MIT)
  • muellan/clipp (license - MIT)
  • Neargye/magic_enum (license - MIT)

• Docs

  • Andrew-Chen-Wang/github-wiki-action (license - Apache 2.0)
  • breathe-doc/breathe (license - BSD)
  • doxygen/doxygen (license - GPL 2.0)
  • readthedocs/sphinx_rtd_theme (license - MIT)
  • sphinx-doc/sphinx (license - BSD)

Although not used by LSA Whisperer, the following projects greatly helped in its development:

• Impacket (Alberto Solino) - A collection of Python classes for working with network protocols
• Kekeo (Benjamin Delpy) - A little toolbox to play with Microsoft Kerberos in C
• Mimikatz (Benjamin Delpy) - A little tool to play with Windows security
• NtObjectManager (James Forshaw) - A library to access the NT object manager namespace
• ROADtools (Dirk-jan Mollema) - The Azure AD exploration framework
• Rubeus (Will Schroeder, Charlie Clark) - A C# toolset for raw Kerberos interaction and abuses

Acknowledgments

Thank you to SpecterOps for supporting this research and to my coworkers who have helped with its development.

Thank you Elad and Lee for both inspiring this tool and the research, support, and collaboration throughout its development. Elad additionally developed operational use cases for msv1_0 and Lee both introduced me to cloudap and showed it's potential for recovering authentication data. Thank you as well to Will for always being a good sounding board and helping test the tool, Daniel for answering my AzureAD questions, and Kai for helping both research cloudap and add Kerberos support.

Related Work

• Adam Chester (2019), showed a POC for SPM's AddPackage API
• Alex Short (2023), showed POCs for ARSO and TBAL
• Mor Rubin (2020), created tools and techniques for NegoEX
• Dr. Nestori Syynimaa (2017-Current), for the Office 365 blog
• Passcape Software (2019), documented ARSO and TBAL
• Steve Syfuhs (2017-Current), for the Windows Authentication blog posts