Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/seventeenman/CallBackDump
dump lsass进程工具
https://github.com/seventeenman/CallBackDump
Last synced: 22 days ago
JSON representation
dump lsass进程工具
- Host: GitHub
- URL: https://github.com/seventeenman/CallBackDump
- Owner: seventeenman
- Created: 2022-09-25T08:29:14.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2023-07-20T09:03:33.000Z (over 1 year ago)
- Last Synced: 2024-08-05T17:27:06.425Z (4 months ago)
- Language: C++
- Homepage:
- Size: 51.3 MB
- Stars: 538
- Watchers: 8
- Forks: 73
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - seventeenman/CallBackDump - dump lsass进程工具 (C++)
- StarryDivineSky - seventeenman/CallBackDump
README
# CallBackDump
能过国内杀软的dump lsass进程工具,参考代码链接在下面。
由minidumpCallback实现,对缓冲区中内存做了些修改后再写入磁盘,同时做了一些小细节修改。
需要注意的是别扔云沙箱,这工具也没有任何网络行为。
![image-20220928231219634](assets/image-20220928231219634.png)
![image-20220928231615029](assets/image-20220928231615029.png)
![image-20220928231846196](assets/image-20220928231846196.png)
# 环境
VS2022
# 用法
`CallbackDump.exe to` 将lsass进程dump成VM21-6-8.log
`dumpXor.exe VM21-6-8.log 1.bin` 将加密的进程文件解密
# 详解
[Dumping Lsass Process Memory In Different Ways - 跳跳糖](https://tttang.com/archive/1810/)
# 参考链接
https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass