lsassy 0.1.1

Python library to parse remote lsass dumps

lsassy

Python library to remotely parse lsass dump and extract credentials. This library uses impacket projects to remotely read necessary bytes in lsass dump and pypykatz to extract credentials.

Requirements

• Python >= 3.6
• pypykatz >= 0.3.0
• impacket

Basic Usage

lsassy [<domain>/]<user>[:<password>]@<target>:/share_name/path/to/lsass.dmp [--hashes [LM:]NT]

CrackMapExec module

I wrote a CrackMapExec module that uses lsassy to extract credentials on compromised hosts

CrackMapExec module is in cme folder : CME Module

Examples

lsassy

lsassy ADSEC.LOCAL/jsnow:Winter_is_coming_\!@dc01.adsec.local:/C$/Windows/Temp/lsass.dmp

lsassy Administrateur:[e-mail]:/ADMIN$/lsass.dmp

CME Module

Installing

From pip

python3.7 -m pip install lsassy

From sources

python3.7 setup.py install

Acknowledgments

• Impacket
• SkelSec for Pypykatz, but also for his patience and help
• mpgn for his help and ideas