ivancabrera02 / SrHollow

# SrHollow
LSA secrets extraction, reuse a preexisting VSS shadow copy + inline `regf` parser + AES-256 LSA decrypt via `bcrypt.dll`.
## Chain in 6 steps
1. **Enumerate `\GLOBAL??`** via `NtOpenDirectoryObject` + `NtQueryDirectoryObject`. Pick the highest-numbered `HarddiskVolumeShadowCopyN`.
2. **If none exists**, fall back to `SRSetRestorePointW(BEGIN_SYSTEM_CHANGE, DEVICE_DRIVER_INSTALL)` from `SrClient.dll`.
3. **Enable `SeBackupPrivilege`** in the current token (`AdjustTokenPrivileges`).
4. `CreateFileW("\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\System32\config\{SECURITY,SYSTEM}", FILE_FLAG_BACKUP_SEMANTICS)` and read to `byte[]`.
5. **Inline `regf` walker** parses the hive: base block, cell types `nk`/`vk`/`lf`/`lh`/`li`/`ri`/`db`/`sk`. `KeyNode` layout, flags @0x02, subkey list @0x1C, value list @0x28, security key @0x2C, class off @0x30, name len u16 @0x48, **class len u16 @0x4A** (this was a bug on first pass — Microsoft's own docs are ambiguous here), name @0x4C.
6. **Derive keys**:
 - **BootKey (SYSKEY)**: concat `Class` UTF-16 hex of `ControlSet00N\Control\Lsa\{JD, Skew1, GBG, Data}` → 16 raw bytes → permute with `[8,5,4,2,11,9,13,3,0,6,1,12,14,10,15,7]`.
 - **LSA AES-256 key** from `Policy\PolEKList\(default)` (172 bytes): `salt = bytes[0x1C..0x3C]`; `tmpKey = SHA-256(BootKey || salt * 1000)`; `pt = AES-256-CBC-decrypt(bytes[0x3C..], tmpKey, IV=0)`; LSA key = `pt[68..100]`.
 - **Each secret** under `Policy\Secrets\ \CurrVal\(default)`: same layout, salt-stretch with the LSA key instead of BootKey.
 - `DPAPI_SYSTEM` body: `bytes[4..24]` = **MachineKey**, `bytes[24..44]` = **UserKey**. These decrypt every SYSTEM-scoped DPAPI master key on the host.
## Repository layout
 [code] 
`src/SrHollow.cs` has **zero dependencies** beyond `System.Security.Cryptography` (which itself proxies to `bcrypt.dll`). It compiles as-is via `Add-Type` or `csc.exe`.
## Usage
Elevated PowerShell
 [code] 
Requires: local admin (for `SeBackupPrivilege`), a `Volume Shadow Copy` service that is running or startable (default on Windows 10/11).
Attributable signals left when a shadow **already exists**:
- One `CreateFileW` on `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\...`
- One `AdjustTokenPrivileges` enabling `SeBackupPrivilege`
- Standard `SHA-256` + `AES-CBC` via `bcrypt.dll` (userland, unremarkable)
This is the same file-open profile as most legitimate backup agents.