Adds README

2026-06-21 13:42:13 +00:00 · 2021-07-01 16:25:55 +02:00
parent 2343ed79ce
commit 246efeb588
1 changed files with 32 additions and 1 deletions
@@ -1 +1,32 @@
-# PowerLsassSilentProcessExit
+# PowerLsassSilentProcessExit
+
+PowerShell script to dump lsass.exe process memory to disk for credentials extraction via silent process exit mechanism.
+
+## Description
+
+The script causes WerFault.exe to dump lsass.exe process memory to disk for credentials extraction via silent process exit mechanism without crasing lsass.exe. This technique is adapted from: https://github.com/deepinstinct/LsassSilentProcessExit
+
+## Parameters
+
+### DumpMode
+
+- 0 - Call RtlSilentProcessExit on LSASS process handle
+- 1 - Call CreateRemoteThread with RtlSilentProcessExit on LSASS
+
+### DumpPath
+- Path wherer the dumpfile shall be stored
+
+### Demo
+
+The following demo shows the dumping:
+
+![Demo](demo.gif)
+
+## Known Issue
+
+At the time of writing, we could not get the DumpMode 1 (using CreateRemoteThread) to work.
+
+## Authors
+
+- Ville Koch ([Twitter](https://twitter.com/vegvisir87))
+- Sylvain Heiniger ([Twitter](https://twitter.com/sploutchy))