mimikatz # sekurlsa::minidump <dumpfile> mimikatz # sekurlsa::logonPasswords full
pypykatz: If you prefer to stay on linux, you can use the python3 port of mimikatz called pypykatz.
bash restore_signature.sh <dumpfile>
3. Process forking
To avoid opening a handle to LSASS with PROCESS_VM_READ, you can use the --fork parameter. This will make nanodump create a handle to LSASS with PROCESS_CREATE_PROCESS access and then create a ‘clone’ of the process. This new process will then be dumped. While this will result in a process creation and deletion, it removes the need to read LSASS directly.
Similarly to the --fork option, you can use --snapshot to create a snapshot of the LSASS process. This will make nanodump create a handle to LSASS with PROCESS_CREATE_PROCESS access and then create a snapshot of the process using PssNtCaptureSnapshot. This new process will then be dumped. The snapshot will be freed automatically upon completion.
5. Handle duplication
As opening a handle to LSASS can be detected, nanodump can instead search for existing handles to LSASS. If one is found, it will copy it and use it to create the minidump. Note that it is not guaranteed to find such handle.
To avoid opening a handle to LSASS, you can use MalSecLogon, which is a technique that (ab)uses CreateProcessWithLogonW to leak an LSASS handle. To enable this feature, use the --malseclogon parameter. Take into account that an unsigned nanodump binary needs to be written to disk to use this feature.
7. MalSecLogon and handle duplication
As said before, using MalSecLogon requires a nanodump binary to be written to disk. This can be avoided if --malseclogon and --dup are used together with --binary. The trick is to leak a handle to LSASS using MalSecLogon, but instead of leaking it into nanodump.exe, leak it into another binary and then duplicate the leaked handle so that nanodump can used it.
8. Load nanodump as an SSP
You can load nanodump as an SSP in LSASS to avoid opening a handle. The dump will be written to disk with an invalid signature at C:\Windows\Temp\report.docx by default. Once the dump is completed, DllMain will return FALSE to make LSASS unload the nanodump DLL. To change the dump path and signature configuration, modify the function NanoDump in entry.c and recompile.
Upload and load a nanodump DLL
If used with no parameters, an unsigned nanodump DLL will be uploaded to the Temp folder. Once the dump has been created, manually delete the DLL with the delete_file command.
If you are using an HTTPS redirector (as you should), you might run into issues when downloading the dump filessly due to the size of the requests that leak the dump. Increase the max size of requests on your web server to allow nanodump to download the dump.