DuplicateDump

DuplicateDump DuplicateDump는 MirrorDump의 포크로서 다음과 같은 수정 사항이 있습니다: DInovke 구현 LSASS 덤프 후 정리할 수 있는 C++로 작성된 LSA 플러그인 DLL. MirrorDump는 LSA 플러그인을 .NET 어셈블리로 컴파일하여 LSASS 프로세스에 의해 언로드되지 않습니다. 그래서 MirrorDump는 플러그인을 삭제하지 못했습니다. 덤프 프로세스즉, DuplicateDump의 PID가 명명된 파이프를 통해 LSA 플러그인에 공유됩니다. LSASS PID 대신 값 "0"...

DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin

DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete...

Dumping LSASS in memory undetected using MirrorDump

Introduction As I am sure some of you are aware from the occasional ramblings and screenshots on twitter, I am a big fan of .NET based offensive tooling. Not because it’s trendy or cool, but because of the development speed and ease of testing and debugging in comparison to C/C++. A month or so a...