Skip to content

Latest commit

 

History

History
22 lines (14 loc) · 762 Bytes

README.md

File metadata and controls

22 lines (14 loc) · 762 Bytes

Silent Lsass Dump

Dump the LSASS process via the silent process exit mechanism into the C:\Temp directory. This implementation use direct syscall generated with @Outflanknl's InlineWhispers.

Only the first method describe in the article Lsass Memory Dumps are Stealthier than Ever Before – Part 2 has been implemented.

All credit to @deepinstinct and their LsassSilentProcessExit project.

Compile

make

Usage

Load the provided aggressor script. After you found the LSASS PID, run the command:

silentLsassDump <LSASS PID>