RToolZ

RToolZ Ein verdeckter Lsass-Dumper - kann den ProcExp152.sys-Treiber ausnutzen, um PPL-Lsass zu dumpen. Was ist das Besondere daran? Es werden keine Aufrufe an MiniDump oder irgendwelche dbghelp.lib-Methoden verwendet, der gesamte Dump-Vorgang wird MANUELL vom Dumper durchgeführt, wobei die...

LetMeowIn

LetMeowIn Um dumper de LSASS sofisticado e furtivo usando C++ e MASM x64. Como visto em Binary Defense e Cyber Security News Disclaimer Não use isso para o mal. Criei esta ferramenta para aprender. Não sou responsável se os Federais baterem na sua porta. Historicamente foi capaz de e pode ainda...

HandleKatz - PIC Lsass Dumper Using Cloned Handles

This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file ...