[Feature-request] Credential guard bypass about pypykatz HOT 2 CLOSED

Hello, thank you for reaching out.
I read this article when it came out and while I find it an interesting attack vector I don't really see a reason why this should be implemented in pypykatz. My concerns are as follows:

1. I consider this technique as kind of a backdoor (as you'd need to get users to re-authenticate in order to get the secrets) which is not really in-line with pypykatz project main goal of dumping/parsing lsass
2. I don't see a reason to implement this attack in python, pypykatz will be able to parse the secrets once the attack is performed via other means. (If it doesn't work out of the box right now then let me know and I can make some changes to the code)
3. The PoC code you supplied uses fixed address offsets to read and modify the necessary variables. This is not really good because pypykatz aims to be compatible on as many systems as possible so for each version of wdigest.dll I'd need to get the offsets. (but if someone has a better approach that makes the offset finding universal pls feel free to let me know) This is a lot of work and I don't see benefits for that.

I'll leave this issue open for discussion for a few weeks or so.

from pypykatz.

No takers so far, so I'm closing this issue

from pypykatz.