$ show dazzyddos/lsawhisper-bof
LSA Whisperer BOF is a Cobalt Strike Beacon Object File (BOF) port of Evan McBroom's LSA Whisperer tool, enabling red team operators to interact with Windows authentication packages (MSV1_0, Kerberos, CloudAP) through legitimate LSA client APIs (LsaCallAuthenticationPackage). It recovers DPAPI credential keys (including under Credential Guard), dumps Kerberos tickets as base64 .kirbi blobs, performs selective ticket purging, extracts Entra ID/AD FS SSO cookies, and generates NTLMv1 responses for hash cracking—all without opening handles to LSASS or touching process memory. The architecture comprises three independent BOF modules (msv1_0, kerberos, cloudap) sharing a common LSA communication layer and comprehensive header definitions for undocumented LSA structures. The code is well-structured, handles privilege separation (untrusted vs. trusted LSA connections), and provides detailed error messages. It targets red team operations and requires Cobalt Strike for execution.
The LLM identified 3 files worth highlighting for reuse:
Comprehensive, well-documented C header containing all necessary struct definitions for MSV1_0, Kerberos, and CloudAP authentication package protocols, including undocumented message types and call IDs. This is the most reusable component—any BOF or C project that needs to call LsaCallAuthenticationPackage with these packages can include this header directly, eliminating research effort. The structs are annotated with field meanings and default values gleaned from reverse engineering, making it a valuable reference.
Core LSA communication layer providing wrappers for LsaConnectUntrusted/LsaRegisterLogonProcess, package lookup, and LsaCallAuthenticationPackage with proper cleanup. Includes LUID parsing (hex/decimal), safe Unicode string printing, HexDump/HexString formatting, Base64 encoding for ticket export, and NTSTATUS error translation. This module is directly included into each BOF and could be extracted as a reusable BOF utility library for any Windows authentication package interaction.
Declares all required Windows API imports for BOF dynamic function resolution (DECLSPEC_IMPORT) organized by DLL (secur32, advapi32, kernel32, ntdll, msvcrt). Includes convenience macros for heap allocation and string operations. This pattern is essential for BOF development and the declarations are correctly scoped and comprehensive, making it a reusable template for other BOF projects targeting LSA operations.