# Gifting User Passwords to Adversaries With NPPSPY

Threat actor deployed NPPSPY on a compromised Exchange server, registering a malicious network provider DLL to capture cleartext usernames and passwords during Winlogon authentication.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2022-08-16
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:windows technique:source-review vuln:secrets-leak

**Target:** Windows Winlogon/mpnotify network provider (Exchange server host)
**Root cause:** Winlogon sends cleartext credentials over RPC to mpnotify.exe, which forwards them to registered network provider DLLs; an attacker-registered provider DLL intercepts and writes them to disk.
**Steps:**
1. Gain privileged access to host
2. Drop attacker DLL at `C:\Windows\System32\lsass.dll`
3. Create registry value `logincontrol` under `HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order`
4. Create key `HKLM\SYSTEM\CurrentControlSet\Services\logincontroll\NetworkProvider` pointing to `C:\Windows\System32\lsass.dll`
5. Wait for user logons; cleartext creds written to `C:\Windows\Temp\tmpCQOF.tmp` as Username -> Password
**How found:** During intrusion response, forensics (Jamie Levy, Harlan Carvey) flagged `C:\Windows\System32\lsass.dll` tied to a compromised account; team dissected the DLL, hypothesized NPPSPY, verified in a lab, then matched registry artifacts on the host.
**Exploitation:** Attacker with admin rights registered a backdoored network provider DLL; on each interactive/Exchange authentication, Winlogon's cleartext credential exchange was captured to a hardcoded temp file, yielding cleartext usernames and passwords including email account creds.
**Escalation:** Targeting an Exchange server swept up email account credentials from users merely accessing their mail, broadening credential harvest beyond local logons.
**Insight:** A DLL masquerading as lsass.dll in System32 plus a NetworkProvider registry entry is the tell; and placing such a provider on an Exchange server harvests email creds from users who never log on locally.