Cyber security

LsassReflectDumping – A Deep Dive Into Secure Credential Extraction Techniques

This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process.

Once the clone is created, it utilizes MINIDUMP_CALLBACK_INFORMATION callbacks to generate a memory dump of the cloned process.

Steps

  • Getting the handle of Lsass.exe process
  • Cloning Lsass.exe process using RtlCreateProcessReflection (Process Forking)
  • Using MINIDUMP_CALLBACK_INFORMATION callbacks to create cloned process minidump
  • Confirming the dump content and size.
  • Terminating the cloned process.

Usage

Simply execute the compiled file.

ReflectDump.exe 

Offline Dumping

Use Mimikatz or Pypykatz to parse the dump file offline.

sekurlsa::minidump [filename] sekurlsa::logonpasswords
pypykatz lsa minidump [filename]

Upcoming Features

* Encrypt dump before writing on disk to bypass static detection.
* Exfiltrate on C2 Server
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

3 days ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

3 days ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

3 days ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

3 days ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

3 days ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

3 days ago