RToolZ

RToolZ A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass. What Is So Special About It? No calls to MiniDump or any dbghelp.lib methods, all of the dumping process is done MANUALLY by the dumper while reducing the dump size to minimal by removing unessacery DLLs. Methods ...

LetMeowIn

LetMeowIn A sophisticated, covert LSASS dumper using C++ and MASM x64. As seen on Binary Defense and Cyber Security News Disclaimer Don't be evil with this. I created this tool to learn. I'm not responsible if the Feds knock on your door. Historically was able to and may presently still bypass...

HandleKatz - PIC Lsass Dumper Using Cloned Handles

This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file ...