physmem2profit

Physmem2profit Physmem2profit può essere utilizzato per creare un minidump del processo LSASS di un host target analizzando la memoria fisica da remoto. L'intento di questa ricerca è proporre un approccio alternativo al furto di credenziali e creare un framework modulare che possa essere esteso p...

nanodump

NanoDump Uno strumento flessibile che crea un minidump del processo LSASS. Indice 1. Utilizzo 2. Caratteristiche 3. Tecniche combinate 4. Esempi 5. Reindirizzatori HTTPS 1. Utilizzo root@kitploit: usage: Z:\nanodump.x64.exe --write C:\Windows\Temp\doc.docx --valid --duplicate --elevate-handle...

POSTDump

POSTDump Un altro strumento per eseguire il minidump del processo LSASS utilizzando poche tecniche per evitare il rilevamento. POSTDump è l'implementazione C / .NET della funzione minidump di ReactOS come nanodump, evitando così la chiamata alla funzione MiniDumpWriteDump dell'API di Windows. Il...

TrickDump

TrickDump TrickDump dumpt den lsass-Prozess, ohne eine Minidump-Datei zu erstellen, und generiert stattdessen 3 JSON- und 1 ZIP-Datei mit den Speicherbereichs-Dumps. In drei Schritten: Lock : Betriebssysteminformationen mit RtlGetVersion abrufen. Shock : SeDebugPrivilege-Berechtigung mit...

NativeDump

NativeDump NativeDump consente di dumpare il processo lsass utilizzando solo NTAPI, generando un file Minidump con solo gli stream necessari per essere analizzati da strumenti come Mimikatz o Pypykatz Stream SystemInfo, ModuleList e Memory64List. NTOpenProcessToken e NtAdjustPrivilegeToken per...

dumpulator

dumpulator Nota: Questo è un prototipo in fase di sviluppo, trattatelo come tale. Le pull request sono benvenute! Potete iniziare conbuone prime issue Una libreria facile da usare per emulare codice in file minidump. Ecco alcuni link a post/video che utilizzano dumpulator: Video introduttivo con...

BeaconEye

BeaconEye Introduzione BeaconEye scansiona i processi in esecuzione per cercare beacon CobaltStrike attivi. Quando vengono trovati processi che eseguono un beacon, BeaconEye monitora ciascun processo per attività C2. Come funziona BeaconEye scansiona i processi live o i file MiniDump per cercare...

NtDumpBOF

NtDumpBOF BOF-Portierung des Tools https://github.com/ricardojoserf/NativeDump, geschrieben von @ricardojoserf. Importiere NtDump.cna und führe aus: root@kitploit: ntdump Die Minidump-Datei wird im Speicher erstellt und mithilfe von CALLBACKFILE und CALLBACKFILEWRITE heruntergeladen. Nach dem...

LsassReflectDumping

LsassReflectDumping यह टूल RtlCreateProcessReflection API का उपयोग करके Process Forking तकनीक का लाभ उठाता है, ताकि lsass.exe प्रक्रिया का क्लोन बनाया जा सके। क्लोन बनने के बाद, यह क्लोन की गई प्रक्रिया का मेमोरी डंप उत्पन्न करने के लिए MINIDUMPCALLBACKINFORMATION कॉलबैक का उपयोग करता है। चरण...

dumpscan

Public development on this tool has been paused but is still being worked on privately. Expect a massive update Q3/Q4 2024. Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3. Features x509...

WSASS

WSASS Questo è uno strumento che utilizza il vecchio programma WerfaultSecure.exe per eseguire il dump della memoria dei processi protetti da PPL Protected Process Light, come LSASS.EXE. L'output è in formato Windows MINIDUMP. Questo strumento sostituisce automaticamente l'intestazione magica"MDM...

CVE-2026-72216

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

UBUNTU-CVE-2026-72216

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

CVE-2026-72216

In the Linux kernel, CVE-2026-72216 affects the remoteproc/qcom path, where a leak occurs when adding custom dump_segments fails. The fix frees the allocated minidump_region 'name' if the region is not added to dump_segments, preventing a leak; it also ensures an error is returned when adding to ...

CVE-2026-72216 remoteproc: qcom: Fix leak when custom dump_segments addition fails

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

CVE-2026-72216 remoteproc: qcom: Fix leak when custom dump_segments addition fails

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

EUVD-2026-58974

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dumpsegments addition fails Free allocated minidumpregion 'name' in qcomaddminidumpsegments when failing before adding the region to 'dumpsegments'. Otherwise, the 'name' is not tracked and ...

PT-2026-72404

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump segments addition fails Free allocated minidump region 'name' in qcom add minidump segments when failing before adding the region to 'dump segments'. Otherwise, the 'name' is not tracke...

NativeDump - Dump Lsass Using Only Native APIs By Hand-Crafting Minidump Files (Without MinidumpWriteDump!)

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the "SeDebugPrivilege"...

Nanodump - A Crappy LSASS Dumper With No ASCII Art

A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls with SysWhispers2 for most operations. Syscalls are called from an ntdll address to bypass some syscall detections. It sets the syscall callback hook to NULL. Windows APIs are called using dynamic invoke...