DuplicateDump

DuplicateDump DuplicateDump 是 MirrorDump 的一个分支，进行了以下修改： DInovke 实现 用 C++ 编写的 LSA 插件 DLL，可在转储 LSASS 后清理。MirrorDump 将 LSA 插件编译为 .NET 程序集，该程序集无法被 LSASS 进程卸载，因此 MirrorDump 无法删除该插件。 转储进程（即 DuplicateDump）的 PID 通过命名管道共享给 LSA 插件 向 MiniDumpWriteDump 传递值 "0" 而非 LSASS 的 PID。这可以防止 MiniDumpWriteDump 打开自己的 LSA...

DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin

DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete...

Dumping LSASS in memory undetected using MirrorDump

Introduction As I am sure some of you are aware from the occasional ramblings and screenshots on twitter, I am a big fan of .NET based offensive tooling. Not because it’s trendy or cool, but because of the development speed and ease of testing and debugging in comparison to C/C++. A month or so a...