NativeDump

NativeDump NativeDump permite volcar el proceso lsass usando solo NTAPIs generando un archivo Minidump con solo los streams necesarios para ser analizados por herramientas como Mimikatz o Pypykatz SystemInfo, ModuleList y Memory64List Streams. NTOpenProcessToken y NtAdjustPrivilegeToken para...

NativeDump - Dump Lsass Using Only Native APIs By Hand-Crafting Minidump Files (Without MinidumpWriteDump!)

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the "SeDebugPrivilege"...