[carlospolop]

Blog URL

https://core-jmp.org/2026/09/domain-credential-dumping-file-handle-redirection

Blog Title

Domain Credential Dumping via File Handle Redirection

Blog high summary

On a lab Domain Controller, the post extends SAM-hive handle redirection: a GIO-class BYOVD kernel R/W primitive rewrites a notepad.exe handle’s _HANDLE_TABLE_ENTRY.LowQword to existing SYSTEM, ntds.dit, and SECURITY _FILE_OBJECTs. Driver-loading capability is prerequisite; HVCI and Microsoft’s vulnerable-driver blocklist should stop it. No CVE is cited, and kernel write on the DC is already compromise.

Three redirects use 4-KB-aligned, 64-KiB OVERLAPPED reads to copy the hives without LSASS, VSS, or opening target paths. Impacket secretsdump.py extracts LSA material; v0.13.1 hits NTDSHashes...trustKeys, while a current version completes NTDS hashes. Hunt driver loads, class-0x10 enumeration, path mismatches, and Public/Temp copies.

PR changes

• src/binary-exploitation/windows-kernel-exploitation/file-handle-table-object-redirection.md: Added a kernel file-object redirection workflow, its layout and I/O constraints, failure modes, and a cross-link to NTDS credential guidance.
• src/windows-hardening/stealing-credentials/README.md: Linked the NTDS credential section to the distinct kernel handle-table redirection technique.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The handle-table mechanism, layout constraints, read requirements, and restoration failure mode are supported by the original project and are absent from related book pages. The duplicated offline extraction example was removed; the original code example was preserved.

Head: e18f559fd99315d254691f59a8bbdddcf1ecc98a

[carlospolop]

merge