From 246efeb588e26aaf590d925bf5bb2aac91210cec Mon Sep 17 00:00:00 2001 From: Sylvain Heiniger Date: Thu, 1 Jul 2021 16:25:55 +0200 Subject: [PATCH] Adds README --- README.md | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 350517b..09e1238 100644 --- a/README.md +++ b/README.md @@ -1 +1,32 @@ -# PowerLsassSilentProcessExit \ No newline at end of file +# PowerLsassSilentProcessExit + +PowerShell script to dump lsass.exe process memory to disk for credentials extraction via silent process exit mechanism. + +## Description + +The script causes WerFault.exe to dump lsass.exe process memory to disk for credentials extraction via silent process exit mechanism without crasing lsass.exe. This technique is adapted from: https://github.com/deepinstinct/LsassSilentProcessExit + +## Parameters + +### DumpMode + +- 0 - Call RtlSilentProcessExit on LSASS process handle +- 1 - Call CreateRemoteThread with RtlSilentProcessExit on LSASS + +### DumpPath +- Path wherer the dumpfile shall be stored + +### Demo + +The following demo shows the dumping: + +![Demo](demo.gif) + +## Known Issue + +At the time of writing, we could not get the DumpMode 1 (using CreateRemoteThread) to work. + +## Authors + +- Ville Koch ([Twitter](https://twitter.com/vegvisir87)) +- Sylvain Heiniger ([Twitter](https://twitter.com/sploutchy))