Skip to content

Dumping LSASS with a duplicated handle from custom LSA plugin

Notifications You must be signed in to change notification settings

Hagrid29/DuplicateDump

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 

Repository files navigation

DuplicateDump

DuplicateDump is a fork of MirrorDump with following modifications:

  • DInovke implementation
  • LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete the plugin.
  • PID of dump process (i.e., DuplicateDump) is shared to LSA plugin through named pipe
  • Passing value "0" instead of LSASS PID to MiniDumpWriteDump. This prevent MiniDumpWriteDump from opening its own handle to LSASS

DuplicateDump add custom LSA plugin that duplicate LSASS process handle from the LSASS process to DuplicateDump. So DuplicateDump has a ready to use process handle to LSASS without invoking OpenProcess.

Testing

By loading DuplicateDump in memory, it was able to dump LSASS memory without detection on

  • Symantec 14.3
  • Kaspersky Enterprise
  • Windows Defender

Detected by Cortex XDR, Crowdstrike. Failed to dump lsass without detection on SentinalOne.

Usage

Compile LSA plugin (export either SpLsaModeInitialize or dllMain function) and provide the full path of DLL to DuplicateDump

.\DuplicateDump.exe --help
  -f, --filename=VALUE       The path to write the dump file to
  -p, --plugin=VALUE         Full file path to LSA plugin
  -c, --compress             GZip and delete the dump file on disk
  -d, --DebugPriv            Obtain SeDebugPrivilege
  -h, --help                 Display this help

Example

.\DuplicateDump.exe -f test -c -p C:\LSAPlugin.dll
[+] Loading LSA security package
[+] Named pipe connected and replying with current PID 6492
[+] Found duplicated LSASS process handle 0x3d0
[+] Compressed dump file saved to test.gz

Improvement

  • DuplicateDump use DInvoke to call API AddSecurityPackage to load a LSA plugin. You could use RPC call without having to invoke that API call directly. Check details in XPN's blog post

  • Recently, splinter_code discovered that SecLogon could be leveraged to dump LSASS. Strongly recommend you to study his blog post.

References

About

Dumping LSASS with a duplicated handle from custom LSA plugin

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published