LSASS secrets
MITRE ATT&CK™ Sub-technique T1003.001
Last updated
Was this helpful?
MITRE ATT&CK™ Sub-technique T1003.001
Last updated
Was this helpful?
The Local Security Authority Subsystem Service (LSASS) is a Windows service responsible for enforcing the security policy on the system. LSASS hosts security-related services such as :
AuthN SSPI: An API, allowing applications to use network security protocols
SAM: Interface for the .
Vault: Allowing to manage credentials in the .
Audit: Enforced audit policy to generate audit records in the security event log.
Key Isolation: Provides key process isolation to private keys and associated cryptographic operations
EFS: Allow to perform some cryptographic operations for File encryption
DPAPI: Interface for the CryptAPI library, allowing to protect data.
LSASS operations lead to the storage of credential material in its process memory. With administrative rights only, this material can be harvested (either locally or remotely).
Mimikatz support in memory SSP DLL injection to the LSASS process.
Alternatively, we may modify LSA Registry keys to add new SSPs which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called :
(Python) can be used to remotely extract credentials, from LSASS, on multiple hosts. As of today (22/07/2020), it is the Rolls-Royce of remote lsass credential harvesting.
several dumping methods: comsvcs.dll, ,
several authentication methods: like (NTLM), or (Kerberos)
it can be used either as a standalone script, as a module or as a Python library
it can interact with a Neo4j database to set targets as "owned"
can be used locally to extract credentials from lsass's process memory, or remotely to analyze a memory dump (dumped with for example).
(Python) can be used remotely (i.e. offline) to analyze a memory dump (dumped with for example).
The legitimate tool (from ) () can be used to dump lsass's process memory.
Once the memory dump is finished, it can be analyzed with (Windows) or (Python, cross-platform).
's exfiltration script (PowerShell) can be used to extract credential material from LSASS's process memory.
Recovered credential material could be either plaintext passwords or NT hash that can be used with (depending on the context).
We may abuse to injected into LSASS.exe process custom SSP DLLs. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
We can directly inject into memory. It prevent us from editing registries but using this approach, it will not persist accross reboot like with .
Below is the code, originally taken from , adapted and refactored, that we can compile as our own Security Support Provider DLL. It intercepts authenticatin details and saves them to a file c:\temp\lsa-pwned.txt:
