MalSeclogon

MalSeclogon A little tool to play with the Seclogon service. Full technical details at: https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html Usage MalSeclogon v0.2 @splintercode Args: -p Pid of the...

NativeDump

NativeDump NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the...

KslKatzBof

KslKatzBOF A Beacon Object File BOF in-line LSASS credential extraction from C2 using the KslD.sys BYOVD technique. This project is based on the blog post: https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team Attribution This BOF is based on KslKatz Maximilia...

GhostKatz

GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian Peña and Eric Esquivel. Thi...

POSTDump

POSTDump Another tool to perform minidump of LSASS process using few technics to avoid detection. POSTDump is the C / .NET implementation of the ReactOS minidump function like nanodump, thus avoiding call to the Windows API MiniDumpWriteDump function. The dump logic code is saved under the...

lsassy

lsassy Python tool to remotely extract credentials on a set of hosts. This blog post explains how it works. This tool uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Chapters| Description ---|--- Warning| Before using this tool, read this...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

DragonCastle

DragonCastle A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a DLL to the target machine. Then it enables remote registry to modify AutodialDLL entry and start/restart BITS service. Svchosts would load our DLL, set...

ColdWer

A cold war on your endpoint. 🥶 ColdWer ColdWer leverages WerFaultSecure.exe PPL bypass to freeze EDR/AV processes and dump LSASS memory on modern Windows systems. C O L D W E R └─┴─┴── WerFaultSecure └─┴──────── LSASS Dump └─┴──────────── Cold Freeze Freeze your EDR/AV. Extract what you need. Sta...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

TrickDump

TrickDump TrickDump dumps the lsass process without creating a Minidump file, generating instead 3 JSON and 1 ZIP file with the memory region dumps. In three steps: Lock : Get OS information using RtlGetVersion. Shock : Get SeDebugPrivilege privilege with NtOpenProcessToken and...

MultiDump

MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xreous.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offe...

WSASS

WSASS Esta es una herramienta que utiliza el antiguo programa WerfaultSecure.exe para volcar la memoria de procesos protegidos por PPL Protected Process Light, como LSASS.EXE. La salida está en formato MINIDUMP de Windows. Esta herramienta reemplaza automáticamente el encabezado mágico"MDMP" por ...

CredsHunter

CredsHunter CVE-2026-3609 · Informe Prueba de concepto de volcado de credenciales LSASS para una fuga de manejadores de procesos que evita PPL en el controlador anti-trampas XIGNCODE3 de Wellbia, xhunter1.sys. El controlador expone una interfaz de comandos IRPMJWRITE que llama a...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

physmem2profit

Physmem2profit Physmem2profit puede utilizarse para crear un minidump del proceso LSASS de un host objetivo mediante el análisis remoto de la memoria física. La intención de esta investigación es proponer un enfoque alternativo al robo de credenciales y crear un marco modular que pueda ampliarse...

Lsass-Shtinkering

Lsass Shtinkering Nuevo método de volcado de LSASS abusando del servicio Windows Error Reporting. Envía un mensaje al servicio mediante el protocolo ALPC para informar de una excepción en LSASS. Este informe hará que el servicio vuelque la memoria de LSASS. Requisitos previos El valor del registr...

impersonate

Impersonate Descripción Este repositorio contiene las herramientas que fueron desarrolladas mientras se escribía la siguiente entrada de blog https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/. La entrada de blog contiene toda la...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

HandleKatz

HandleKatz This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of t...