17 matches found
DuplicateDump
DuplicateDump DuplicateDump — это форк MirrorDump со следующими изменениями: Реализация DInovke LSA-плагин DLL, написанный на C++, который можно очистить после дампа LSASS. MirrorDump компилирует LSA-плагин как сборку .NET, которая не может быть выгружена процессом LSASS. Вот почему MirrorDump не...
HandleKatz
HandleKatz Этот инструмент был реализован в рамках нашего выступления на конференции Brucon2021 и демонстрирует использование клонированных дескрипторов к Lsass для создания обфусцированного дампа памяти того же процесса. Он компилируется в исполняемый файл, полностью находящийся в его текстовом...
blindsight
blindsight 「適者生存」なんてものは存在しない。 おそらく「最も適切な者が生き残る」だけだ。 解決策が最適かどうかは重要ではない。 重要なのは、それが代替案より優れているかどうかだけだ。 -- ピーター・ワッツ、ブラインドサイト 2006 LSASSメモリをダンプし、基本的な対策を回避するレッドチーム用ツールです。 Transactional NTFS（TxF API）を使用してメモリダンプを透過的にスクランブルし、 AV/EDR/XDRをトリガーしないようにします。 記事 https://hnsecurity.it/blog/an-offensive-rust-encore...
Dumpy
설명 이 도구는 MiniDumpWriteDump를 동적으로 호출하여 lsass 메모리 콘텐츠를 덤프합니다. 이 과정은 lsass에 대한 새 프로세스 핸들을 열지 않고 수행되며, 악성 동작 탐지를 더 어렵게 만들기 위해 DInvokers를 사용합니다. lsass에 대해 OpenProcess를 호출하지 않고 유효한 프로세스 핸들을 얻기 위해, 시스템의 모든 프로세스 핸들은 NtQuerySystemInformation, NtDuplicateObject, NtQueryObject 및 QueryFullProcessImageNameW를...
LsassReflectDumping
LsassReflectDumping Questo strumento sfrutta la tecnica di Process Forking utilizzando l'API RtlCreateProcessReflection per clonare il processo lsass.exe. Una volta creato il clone, utilizza i callback MINIDUMPCALLBACKINFORMATION per generare un memory dump del processo clonato. Passaggi Ottenere...
WSASS
WSASS Questo è uno strumento che utilizza il vecchio programma WerfaultSecure.exe per eseguire il dump della memoria dei processi protetti da PPL Protected Process Light, come LSASS.EXE. L'output è in formato Windows MINIDUMP. Questo strumento sostituisce automaticamente l'intestazione magica"MDM...
Exploit for Improper Input Validation in Microsoft
🚨 CVE-2026-33826: Windows Active Directory Remote Code Executi...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2 Summary This update addresses a known issue that affects the Local Security Authority Subsystem Service LSASS. It might leak memory on domain controllers DCs. This issue occurs after you install KB5035885 Marc...
March 22, 2024—KB5037422 (OS Build 20348.2342) Out-of-band
None None...
March 12, 2024—KB5035849 (OS Build 17763.5576) - EXPIRED
None None...
March 12, 2024—KB5035857 (OS Build 20348.2340)
None None...
March 12, 2024—KB5035855 (OS Build 14393.6796) - EXPIRED
None None...