MiniDumpWriteDump
In this section we’ll develop our own C# application
to execute a memory dump that we can parse with Mimikatz.
When Task Manager and ProcDump create a dump file,
they are invoking the Win32 MiniDumpWriteDump API.
This means that we can write our own application
in C# that does the same thing.
To begin, we’ll go over the function prototype.
This function requires a lot of arguments,
but only the first 4 are needed for our use case.
The first two arguments must be a handle to LSASS
and the process ID of LSASS, respectively.
The third argument is a handle to the file
that will contain the generated memory dump,
and the fourth is an enumeration type which we’ll set to MiniDumpWithFullMemory,
or its numerical value of 2, to obtain a full memory dump.
With the foundational understanding of the API in place,
we’ll create a Visual Studio C# console App
on the Windows 10 client called MiniDump,
select Release build,
and set the CPU architecture to 64-bit.
Next, we’ll add the P/Invoke translated DllImport statement for MiniDumpWriteDump.
Before we can call MiniDumpWriteDump
we have to set up the four required arguments.
First, we’ll obtain the process ID of LSASS and open a handle to it.
To get the process ID,
we can use the GetProcessesByName method of the Process class,
supplying the process name as a string,
and select the Id property.
We must include the System.Diagnostics namespace
to make use of the Process class.
We can obtain a handle to the LSASS process with the Win32 OpenProcess API,
just as we would with process injection.
We’ll include the DllImport statement for OpenProcess
and supply the arguments for full access,
no inheritance, and the process ID of LSASS:
Now that we have the first two arguments in place, we must set up the dump file.
Instead of using the Win32 CreateFile API,
we can take advantage of the FileStream class along with its constructor.
To instantiate the FileStream object, we must supply two arguments:
the name and full path of the file,
and the FileMode.Create option indicating that we want to create the a new file.
We’ll also include the System.IO namespace to use the FileStream class:
Now that we have all the pieces in place we can invoke MiniDumpWriteFile.
When supplying the file handle argument to MiniDumpWriteDump
we must convert it to a C style file handle
through the DangerousGetHandle method of the SafeFileHandle class.
After compiling the project,
we can execute it from an elevated command prompt and generate a dump file.
With the dump file created,
we can run Mimikatz to parse it as we did in the last example:
The output reveals that our custom C# application did,
in fact, create a valid dump file for LSASS.
By stepping away from pre-developed tools,
we have improved our tradecraft and likely avoided antivirus detection.