One Day Sec

What are the key differences in data structures and offsets when implementing sekurlsa::wdigest across different Windows versions?

The main differences involve the offsets for IV, DES, and AES keys in lsasrv.dll, and the structure of the BCRYPT_KEY used for decryption—Win7 uses `KIWI_BCRYPT_KEY`, while Windows 8 and 10 use `KIWI_BCRYPT_KEY81`. The AES and 3DES decryption keys are stored inside a `KIWI_HARD_KEY` structure, with `cbSecret` indicating the length. These version-specific offsets are detailed in the Mimikatz source and the Implementation of sekurlsa::wdigest in Mimikatz article.
data structuresoffsetsKIWI_BCRYPT_KEYWindows versionsdecryption

Browse all Q&A →