Pentest List Wiki
  • What is Pentest List Wiki?
  • OFFENSIVE SECURITY
    • External Infrastructure
      • Discovery
        • Email Address Discovery
        • Subdomain Discovery
        • Data Discovery
        • Port & Service Discovery
      • Exploitation
        • Password Spraying
        • Vulnerability Scanning
    • Internal Infrastructure
      • General Discovery
        • AD Attack Path Discovery
        • Port & Service Discovery
      • Credential Discovery
        • Passwords and NetNTLM
        • SAM & LSA secrets
        • NTDS.dit secrets
        • LSASS secrets
        • DCSync
        • DPAPI secrets
      • Movement
        • Credential Spraying
        • SMB Relaying
        • Pass The Hash
      • Infiltration/Exfiltration
        • Pivoting (Proxying)
    • Web Application
      • Discovery
        • Testing API Keys
        • Vulnerability Scan
        • Web Content Discovery
        • Parameter Discovery
        • VHOST Discovery
        • CMS Scanners
      • Exploitation
        • Authentication
          • Email Address Forms
          • AWS Cognito
        • JSON Web Tokens
        • Injection Attacks
          • SQL Injection
          • Cross-Site Scripting
          • HTTP Headers
      • Bypasses
        • Cloudflare Bypass
        • HTTP 403 Bypass
    • Mobile (iOS/Android)
      • iOS
        • IPA Decryption
        • Filesystem Analysis
        • Static Analysis
    • Cloud
      • AWS
        • Vulnerability Scanners
        • S3 Buckets
      • Azure
        • Vulnerability Scanners
        • m365 & Entra ID
  • DEFENSIVE SECURITY
    • Forged Kerberos Tickets
    • Logon Event Visualisation
Powered by GitBook
On this page
  • Overview
  • Local Dumping
  • Remotely Dumping (With Credentials)
  1. OFFENSIVE SECURITY
  2. Internal Infrastructure
  3. Credential Discovery

LSASS secrets

How to find sensitive data in the LSASS.

PreviousNTDS.dit secretsNextDCSync

Last updated 11 months ago

Overview

In Windows, the Local Security Authority Subsystem Service (LSASS) is used to enforce security on the system. The LSASS service is used in various tasks, such as overseeing password changes and login, which means that credentials and hashes are stored within the memory for the LSASS process. With administrative rights, the credentials and hashes can be extracted.

Local Dumping

Locally Dumping LSASS

ProcDump is a Windows tool from the sysinternals package and can be used to dump the process memory for LSASS. Due to being a Windows tool, this may be a more legitmate method of dumping LSASS than infiltrating other unsigned attack tools.

The following command will dump the LSASS memory to a .dmp file:

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Credential Extraction

Once the lsass.dmp file has been gained and exfiltrated offline to an attack machine. Mimikatz or pypykatz can be used to extract the data.

After opening mimikatz on the attack machine, the following command should be used:

sekurlsa::minidump "lsass.dmp"

sekurlsa::logonpasswords

After opening pypykatz on the attack machine, the following command should be used:

pypykatz lsa minidump lsass.dmp

Remotely Dumping (With Credentials)

LSASS can be dumped remotely using lsassy, with local administrator credentials. lsassy is a project which ties together two other well known tools, impacket and pypykatz to gain data stored in LSASS .

Dump LSASS credentials with plaintext credentials

lsassy -d <domain> -u <user> -p <password> <target>

Dump LSASS credentials with pass-the-hash (NTLM)

lsassy -u <user> -H <NThash> <target>

Dump LSASS credentials with pass-the-ticket (Kerberos)

lsassy -k <target>

Requires an environment variable to be set, see

https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
https://github.com/gentilkiwi/mimikatz
https://github.com/skelsec/pypykatz
https://github.com/login-securite/lsassy
here