17 matches found
blindsight
blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...
HandleKatz
HandleKatz This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of t...
DuplicateDump
DuplicateDump DuplicateDump es un fork de MirrorDump con las siguientes modificaciones: Implementación de DInovke Plugin DLL de LSA escrito en C++ que se puede limpiar después de volcar LSASS. MirrorDump compila el plugin de LSA como un ensamblado .NET que no se descargaría del proceso LSASS. Por...
Dumpy
Descripción Esta herramienta llama dinámicamente a MiniDumpWriteDump para volcar el contenido de la memoria de lsass. Este proceso se realiza sin abrir un nuevo identificador de proceso process handle hacia lsass y utilizando DInvokers para dificultar la detección de su comportamiento malicioso...
WSASS
WSASS This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL Protected Process Light, such as LSASS.EXE. The output is in Windows MINIDUMP format. This tool automatically replaces the"MDMP" magic header with a PNG magic header. After the dump ...
LsassReflectDumping
LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMPCALLBACKINFORMATION callbacks to generate a memory dump of the cloned process. Steps Getting the handle of...
Exploit for Improper Input Validation in Microsoft
🚨 CVE-2026-33826: Windows Active Directory Remote Code Executi...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2 Summary This update addresses a known issue that affects the Local Security Authority Subsystem Service LSASS. It might leak memory on domain controllers DCs. This issue occurs after you install KB5035885 Marc...
March 22, 2024—KB5037422 (OS Build 20348.2342) Out-of-band
None None...
March 12, 2024—KB5035849 (OS Build 17763.5576) - EXPIRED
None None...
March 12, 2024—KB5035857 (OS Build 20348.2340)
None None...
March 12, 2024—KB5035855 (OS Build 14393.6796) - EXPIRED
None None...