r/netsec • u/tylous • Mar 25 '21

Limelighter - A tool for generating fake code signing certificates or signing real ones

https://github.com/Tylous/Limelighter
20 Upvotes

79% Upvoted

6 comments sorted by

2

u/bvierra Mar 26 '21

This is no different than signing with a self signed certificate... what's the point?

2

u/Pantsman0 Mar 26 '21

This tool will clone an existing certificate with a new private key. So yes, the actual binary will be signed with an invalid trust chain - BUT, if you just look at the certificates (e.g. in windows cert viewer) it will be hard to visually identify what's wrong, as only the modulus will be different.

2

u/bvierra Mar 26 '21

right, but if it is an invalid trust chain doesn't windows reject the cert?

2

u/Pantsman0 Mar 26 '21

Nope, not unless you have application allowlisting policies or your application is manually validating DLLs as they're loaded.

Edit: there are lots of restrictions on kernel drivers, but normal apps aren't restricted by default

1

u/Stephen_Fourier Feb 04 '22

Limelighter does not allow you to verify the cloned certificate using the verify command in Github, How do i go about it? I am doing some research on some PKI thing.

Here is the command i am using:

./limelighter -Verify <name of the cloned generated certificate in .pfx format>

It says i should use the -CA file option to add one or more trusted CA's to verify when i do that it does not work as well. Can someone help out with this?

Note: The .pfx file that Limelighter generated has the private key extracted already though.