Memory Dump
First, we’ll dump the process memory of LSASS.
Windows allows us to create a dump file,
which is a snapshot of a given process.
This dump includes loaded libraries and application memory.
In this example, we’ll create the dump file with
Task Manager.
To open Task Manager we’ll right-click the task bar and select it.
Next, we’ll navigate to the Details tab and locate the lsass.exe process,
right-click it and choose Create dump file.
After dumping the process memory,
the location of the dump file is presented in a popup.
Once the dump file is created, we can copy it from the target
to our local Windows client
where we can parse it with Mimikatz.
In this example, we’ll simulate offline parsing
by copying the dump file to the Mimikatz folder of the Windows 10 victim VM
and we’ll process it with Mimikatz there.
First, we’ll run sekurlsa::minidump,
supplying the name of the dump file to parse,
followed by sekurlsa::logonpasswords to dump cached credentials:
This successfully dumps the admin domain user’s credentials,
and does not require Mimikatz on the target machine.
There is, however, one obvious disadvantage to this technique:
Task Manager cannot be run as a command line tool,
so we’ll need GUI access to the target.
Alternatively, we can create the dump file from the command line
with ProcDump from SysInternals.
Since ProcDump may also have a signature that could be recognized,
in the next section we’ll build our own code
to create the dump file.