February 2018
Intermediate to advanced
396 pages
9h 38m
English
Content preview from Advanced Infrastructure Penetration Testing
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Dumping LSASS memory with Task Manager (get domain admin credentials)
Memory dumping is a classic technique to recover some hidden information, including passwords and credentials. One of the Active Directory techniques is dumping LSASS memory using the Task Manager. Mimikatz has great capabilities, such as the features discussed before; one of them is dumping LSASS memory from the LSASS.dmp file, as shown:
If the operation succeeds, you will receive this message: