NativeDump: dump the lsass process
NativeDump
NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz (SystemInfo, ModuleList, and Memory64List Streams).
- NTOpenProcessToken and NtAdjustPrivilegeToken to get the “SeDebugPrivilege” privilege
- RtlGetVersion to get the Operating System version details (Major version, minor version and build number). This is necessary for the SystemInfo Stream
- NtQueryInformationProcess and NtReadVirtualMemory to get the lsasrv.dll address. This is the only module necessary for the ModuleList Stream
- NtOpenProcess to get a handle for the lsass process
- NtQueryVirtualMemory and NtReadVirtualMemory to loop through the memory regions and dump all possible ones. At the same time it populates the Memory64List Stream
Usage:
The default file name is “proc_.dmp”:
The tool has been tested against Windows 10 and 11 devices with the most common security solutions (Microsoft Defender for Endpoints, Crowdstrike…) and is for now undetected. However, it does not work if PPL is enabled in the system.
Some benefits of this technique are:
- It does not use the well-known dbghelp!MinidumpWriteDump function
- It only uses functions from Ntdll.dll, so it is possible to bypass API hooking by remapping the library
- The Minidump file does not have to be written to disk, you can transfer its bytes (encoded or encrypted) to a remote machine
The project has three branches at the moment (apart from the main branch with the basic technique):
-
ntdlloverwrite – Overwrite ntdll.dll’s “.text” section using a clean version from the DLL file already on disk
-
delegates – Overwrite ntdll.dll + Dynamic function resolution + String encryption with AES + XOR-encoding
-
remote – Overwrite ntdll.dll + Dynamic function resolution + String encryption with AES + Send file to remote machine + XOR-encoding
