The Daily Feed
“Freshly brewed IT security, since 2023”
Tools
Barista: One Exe to Install Doppio and Ristretto
The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.
At the end of the 2FA series you have three things. A credential provider with a TOTP tile from Part 1. An authentication package and an MSV1_0 sub-authentication filter inside LSA from Part 2. And Ristretto from Part 3, a gate that lets network logons through for a few minutes after you type a one-time code.
What you don't have is an easy way to put all of that on a machine. You need the MSVC build tools, two repositories at matching commits, RunAsPPL switched off, an unsigned DLL copied into System32, an enrollment per account, a reindex, and a handful of registry writes that have to happen in a certain order.
