RustiveDump: dump the memory of the lsass.exe process

RustiveDump

RustiveDump is a Rust-based tool designed to dump the memory of the lsass.exe process using only NT system calls.

It creates a minimal minidump file from scratch, containing essential components like SystemInfo, ModuleList, and Memory64List, with support for XOR encryption and remote transmission.

Additionally, RustiveDump now implements the design of Rustic64, allowing it to be compiled as Position Independent Code (PIC), making it more versatile.

This project is a personal learning experience, focusing on leveraging native Windows APIs for memory dumping and building a minimalistic minidump file entirely from the ground up.

Key Features

1. NT System Calls for Everything: RustiveDump bypasses standard APIs and leverages NT system calls for all its operations.

2. No-Std and CRT-Independent:
   RustiveDump is built using Rust’s no_std feature, which removes reliance on Rust’s standard library, and it’s also CRT library independent. This resulting in a lean release build of only 18KB.

3. Position Independent Code (PIC):
   RustiveDump now implements the design of Rustic64, allowing it to be compiled as shellcode (PIC), making it more versatile.

4. Indirect NT Syscalls:
   The tool uses indirect syscalls, retrieving system service numbers (SSN) with techniques like Hell’s Gate, Halo’s Gate, and Tartarus’ Gate.

5. Lean Memory Dump:
   RustiveDump generates a focused memory dump, containing only essential data (i.e., SystemInfo, ModuleList, and Memory64List), ensuring no bloated files—just enough to feed your memory analysis tools like Mimikatz or Pypykatz.

6. XOR Encryption:
   RustiveDump can encrypt the dump file using XOR before saving or transmitting it, adding an extra layer of security to the dumped memory.

7. Remote File Transmission:
   The dump file can be sent directly to a remote server using winsock APIs calls

8. Debug Mode:
   The debug mode provides detailed logs of each step, which can be enabled during the build process.

How it works

1. Enable SeDebugPrivilege:
   RustiveDump uses NtOpenProcessToken and NtAdjustPrivilegesToken to enable SeDebugPrivilege, allowing access to protected processes like lsass.exe.

2. LSASS Process Access:
   The tool locates the lsass.exe process by querying NtQuerySystemInformation to get a snapshot of active processes, and then opens a process handle using NtOpenProcess with the PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access rights.

3. Memory Regions Handling:
   RustiveDump scans through the memory regions of the process using NtQueryVirtualMemory and dumps committed and accessible memory using NtReadVirtualMemory.

4. Module Information:
   RustiveDump retrieves a list of modules loaded by lsass.exe using NtQueryInformationProcess to extract the ModuleList from the remote PEB (Process Environment Block).

5. Memory Dump Creation:
   The dump is saved locally using NtCreateFile and NtWriteFile, or sent to a remote server. If desired, the dump can also be encrypted with XOR before being saved or transmitted.

Download & Use

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy