# Dumping Lsass with trusted processes

In today's blog we will go through some points like:

* **What is LSASS**
* **Why LSASS**
* **LSASS Dumping Techniques**
* **ASR Rules**
* **Proof of Concept**
* **Demo**
* **References**

### What is LSASS

LSASS (Local Security Authority Subsystem Service) is the process on Microsoft Windows that handles all user authentication, password changes, creation of access tokens, and enforcement of security policies. This means the process stores multiple forms of hashed passwords, and in some instances even stores plaintext user passwords.\
So with that we can undetstand that Lsass is very important process.\
We can find the lsass process in task manger -> Details -> lsass.exe:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FPdUQNw2kRe82JRiOTRxS%2FLssass.PNG?alt=media&#x26;token=8f83473a-287b-486a-9f77-6846d37c9c1b" alt=""><figcaption></figcaption></figure>

LSASS contains valuable authentication data such as:

* encrypted passwords
* NT hashes&#x20;
* LM hashes&#x20;
* Kerberos tickets
* Cleartext credentials (if wdigest is enabled)

### **Why LSASS?**

Adversaries or attackers commonly abuse the Local Security Authority Subsystem Service (LSASS) to dump credentials for privilege escalation, data theft, and lateral movement. The process is a fruitful target for adversaries because of the sheer amount of sensitive information it stores in memory.

### **LSASS Dumping Techniques**

There are several techniques and tools to dump lsass such as:

* **Task Manager**
* **Procdump**
* **comsvcs.dll**
* **Mimikatz**
* **PPLdump**&#x20;
* **HandleKatz**&#x20;
* **nanodump**&#x20;
* **safetykatz**
* **.......**

### ASR Rules

Attack surface reduction rules (ASR rules) help prevent actions that malware often abuses to compromise devices and networks. ASR can help detect and prevent targeted exploits. By restricting the ways in which attackers can infiltrate a system, ASR provides an additional layer of defense against cyber threats.\
Below picture we can see all ASR rules and GUID

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FNk8fIFpkhW1w7Y0my8rk%2FASR.PNG?alt=media&#x26;token=f5c4bd3c-42a0-4674-a47c-850679df8881" alt=""><figcaption><p>ASR Rules</p></figcaption></figure>

### Proof Of Concept

So now, After we understand what is lsass and why it's important for the attackers. Now we will go from the attacker's side to see how to exploit it and extract the information. When we try the above techniques Microsoft defender will flag it as malicious because the ASR rule prevents untrusted processes from having direct access to LSASS memory. The picture below explains the Lsass ASR rule:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FAcI5bYr67GBpSamykEVu%2FLsassASR.PNG?alt=media&#x26;token=66be6e08-a5f2-41b1-9c3c-7e9d2eb22864" alt=""><figcaption><p>Lsass Rule</p></figcaption></figure>

After we understand the above rule now our goal is finding a process that is trusted for direct access. After searching on the internet, I found an interesting repository on github that contains all the ASR rules:

{% embed url="<https://github.com/HackingLZ/ExtractedDefender>" %}

Then we go for Lsass rule (**9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2**) page to read the rule.\
Below picture shows the rule **Name**,**Description** and **GetMonitoredLocations**.

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FHkszcFh0J57s6uCvf6fr%2FLsassRule.PNG?alt=media&#x26;token=7c608077-38cd-4bfd-b6c1-f5106a4fbab0" alt=""><figcaption><p>Information</p></figcaption></figure>

So, it functions by filtering the handle returned from OpenProcess to remove read access to the process memory, this preventing its content from being dumped. But at the same time, we found **GetPathExclusions** that contain all the processes that are excluded to have direct access to the LSASS process.

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FVGYBU31tEa62RkAWpcVs%2Fexcluded.PNG?alt=media&#x26;token=25d6f03a-80ea-4352-9c55-054e4f191a71" alt=""><figcaption><p><strong>GetPathExclusions</strong> </p></figcaption></figure>

And also, we can do it in the manual way. First we need to locate the Defender signature files. And we can find these in the following location: `C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup`

In our case, we are primarily interested in the **mpasbase.vdm** file that contain signatures, emulation resources, etc. Then we use this tool to extract it:

{% embed url="<https://github.com/hfiref0x/WDExtract/>" %}

Then we will have mpasbase.vdm.extracted file. After that, we opened the extracted file in HxD to search for the GUID of the ASR rule that we wanted to investigate and in our case we searched for Lsass rule (**9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2**):

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2Feb4R2prZvAhThrXd93Ha%2FExtracted.PNG?alt=media&#x26;token=a3764f90-f3a9-4063-bba2-7a20076a5bd5" alt="" width="563"><figcaption></figcaption></figure>

And in the picture below we see all the excluded programs for Lsass ASR rule:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FpZwmEEzd5Vb1vA5IwFZL%2FExtractedPro.PNG?alt=media&#x26;token=cb6b8656-18a1-48c4-8e0d-a3a4efa62afd" alt="" width="563"><figcaption><p>#Note: <em>It’s important to keep in mind that the list of paths you may see here in the hex dump are not always exclusions. So</em> You will need to do some testing or you can use the above link to the GitHub repository that includes this already extracted data for you</p></figcaption></figure>

After we find and understand what we need now, it's time to let one of these processes access Lsass and dump it. But how will this happen? We will use **(Process Hollowing)** technique.

{% hint style="info" %}
**Process hollowing** is commonly performed by creating a process in a **suspended** state then unmapping/hollowing its memory, which can then be replaced with malicious code.
{% endhint %}

You will be wondering why we create a process in a suspended state ? The idea here is to launch a legitimate process, then replace the content of the process with malicious code and then resume it. The picture below is a simple example for the technique:&#x20;

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FuEZWBH8XAJQQTtgXKDjC%2FSuspended1.PNG?alt=media&#x26;token=6137ab27-6137-4702-b78d-132f74b3b07c" alt=""><figcaption></figcaption></figure>

To achieve this with Process hollowing, we will create a program with the below windows APIs and we will use Lsass dumping shellcode but encrypted with XOR and decrypted when it's running:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FbcDy3l5hEhC7PyrPHlvB%2FProcHolow.PNG?alt=media&#x26;token=ce57d140-5c93-4b73-9c13-970ddbdcbee6" alt="" width="375"><figcaption><p><strong>Process hollowing</strong></p></figcaption></figure>

So, first in our case we use CreateProcess to lunch (mrt.exe) process with suspended state

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FbEHnElRqayscBh9QEQS3%2FCreateProc.PNG?alt=media&#x26;token=150ea94e-4b48-462b-9087-29cc51eb1df9" alt=""><figcaption><p>CreateProcess</p></figcaption></figure>

Then we query the process using ZwQueryInformationProcess

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FVlLlSClkNLu5GaEfm01J%2FZwQueryInformationProcess.PNG?alt=media&#x26;token=4d63b366-a2e7-43b1-b6ed-3ba41a54c67b" alt=""><figcaption><p>ZwQueryInformationProcess</p></figcaption></figure>

After that read the bytes from the process using ReadProcessMemory

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FGg5b54UQiyexpBUFjQ1V%2FReadProcessMemory.PNG?alt=media&#x26;token=ccb26f51-edc9-4d3d-b3bf-59086eabfcdf" alt=""><figcaption></figcaption></figure>

Now we will copy the shellcode, but first we need to have a shellcode to dump lsass for us and we found it in this blog:

{% embed url="<https://osandamalith.com/2019/05/11/shellcode-to-dump-the-lsass-process/>" %}

An extra step to evade detection is we use XOR to encrypt the above shellcode:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FC9ALsXkvNDDHymAiYASs%2FXOREnc.PNG?alt=media&#x26;token=34dbb957-2853-4609-9909-cc613c375d2d" alt=""><figcaption></figcaption></figure>

After XORing our shellcode, we copy it into our program and also use the xor decrypt function to decrypt the shellcode:

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FXkAiNVapbFhjABATb89h%2FEnc.PNG?alt=media&#x26;token=e594153d-dc7f-4306-bf3e-184227519ef4" alt=""><figcaption></figcaption></figure>

Then we write our shellcode using WriteProcessMemory

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FkutW1FpKz1FZeWKIL9DY%2FWriteProc.PNG?alt=media&#x26;token=e103221b-4261-422a-8b24-a33e7889ede4" alt=""><figcaption></figcaption></figure>

And the final thing is to resume the thread using ResumeThread

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2F4Qj3itc7ho7vavW4Y97n%2FResumeThread.PNG?alt=media&#x26;token=29b79bcd-c53b-4c9a-99dd-568bafb16bca" alt=""><figcaption></figcaption></figure>

Now it's time to test our program on Windows machine with MD and ASR rule enabled.

### **Demo**

In the below demo's we tested our program with two technique:

Locally

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FHZ0mpztybXIDGYPFmPI5%2F2023-09-18-02-04-39%20(2).gif?alt=media&#x26;token=b6144c39-e8c4-4591-a757-cbb86fd9db34" alt=""><figcaption></figcaption></figure>

Remotely ( without touching desk )

<figure><img src="https://1686075923-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbNvLcmSUZEVT7HjdnIbl%2Fuploads%2FNHzXV3D77WxiG4UzhPFd%2F2023-09-18-02-12-52.gif?alt=media&#x26;token=a9a38f3b-8f0f-4712-aa5e-3fba77cb4176" alt=""><figcaption></figcaption></figure>

### References

{% embed url="<https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service>" %}

{% embed url="<https://www.thewindowsclub.com/what-is-lsass-exe-in-windows-10>" %}

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide>" %}

{% embed url="<https://github.com/commial/experiments/tree/master/windows-defender/ASR>" %}

{% embed url="<https://redcanary.com/threat-detection-report/techniques/lsass-memory/>" %}

{% embed url="<https://blog.0x4.xyz/bypassing-windows-protection-mechanisms/bypass-asr-rule-and-dump-lsass>" %}

{% embed url="<https://attack.mitre.org/techniques/T1003/001/>" %}

{% embed url="<https://attack.mitre.org/techniques/T1055/012/>" %}
