How davincee/prettyprague works
PrettyPrague is a Windows proof of concept that the README describes as abusing an Avast sandbox vulnerability to dump the SAM database and launch a SYSTEM shell. Its runtime is concentrated in main.cpp: the excerpt shows sandbox-aware dispatch, SAM-related registry and cryptographic operations, password restoration, and shell-launch logic. ntdll.h and offreg.h provide native-API and offline-registry interfaces used by that implementation. The excerpts are partial, so undocumented internal sequencing is omitted; README statements support the high-level capability links.
Main entry points: main.cpp SAM dump workflow · offreg.h Offline hive access · ntdll.h Native API declarations
Components 13
PoC runtime
- Runtime dispatch
main.cpp - Sandbox path
main.cpp - SYSTEM shell
main.cpp
SAM handling
- SAM dump workflow
main.cpp - Offline hive access
offreg.h - Hash decryption
main.cpp - Password handling
main.cpp
Windows interfaces
- Native API declarations
ntdll.h
Other components
- Operator
- Avast sandbox
- SAM database
- SAM dump
- Windows SYSTEM
Connections 12
- Operator → Runtime dispatch: runs
README.md - Runtime dispatch → Sandbox path: dispatches to
main.cpp - Sandbox path → Avast sandbox: abuses sandbox
README.md - Sandbox path → SAM dump workflow: performs
README.md - SAM dump workflow → Offline hive access: reads hive values
main.cpp - SAM dump workflow → Hash decryption: decrypts hashes
main.cpp - SAM dump workflow → SAM database: extracts data
README.md - SAM dump workflow → SAM dump: produces
README.md - Runtime dispatch → SYSTEM shell: launches
README.md - SYSTEM shell → Windows SYSTEM: spawns shell
README.md - SAM dump workflow → Password handling: restores password
main.cpp - Runtime dispatch → Native API declarations: uses native APIs
main.cpp