TGViewer
APT APT @apt_notes · 16.6K subscribers
Post #1100 5.57K
APT 👻 Ghost in the PPL Part 2: From BYOVDLL to Arbitrary Code Execution in LSASS In this second installment, the author deepens the exploration of techniques for bypassing LSASS protection, focusing on arbitrary code execution by refining the PoC, exploiting…
👻 Ghost in the PPL Part 3: LSASS Memory Dump

In the third part of the series, the author explores methods for dumping the memory of LSASS, including indirectly calling MiniDumpWriteDump, loading arbitrary DLLs into LSASS via the WinSock2 Autodial feature, and dynamically resolving addresses.

🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-3/

#lsa #lsass #ppl #dll #maldev
itm4n’s blog Ghost in the PPL Part 3: LSASS Memory Dump Back to the Basics: MiniDumpWriteDump
  • 🔥 7
  • 👍 6
Open in Telegram All posts from @apt_notes
More from @apt_notes
  1. Sep 1, 2026🔒 Certi-Bhai — IIS AppPool → NT AUTHORITY\SYSTEM via AD CS RPC A webshell under IIS AppPo…
  2. Aug 17, 2026🔒 Citrix NetScaler Pre-Auth RCE (CVE-2026-8452) Unauthenticated heap overflow in SAML sig…
  3. Aug 11, 2026Post #1201
  4. Aug 7, 2026ResetNightmare ResetNightmare (CVE-2026-27912) is a validation flaw in the Kerberos Change…
  5. Jul 24, 2026🔒 Certighost (CVE-2026-54121) — AD CS Domain Controller Impersonation Low-privileged doma…
  6. Jul 9, 2026💉 P³ — Shellcode Loader: Process Parameter Poisoning This loader implements a code inject…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →