ShadowDumper - Shadow Dumper is a powerful tool used to dump LSAS

项目说明

ShadowDumper

<di="center";">
<a href=" target="_blank" style="margin: 0 15px; display: inline-block;">
<img src=" alt="Buy Me A Coffee" style="height: 45px; width: 162px;">
</a>
<a href=" target="_blank" style="margin: 0 15px; display: inline-block;">
<img src=" alt="Donate with PayPal" style="height: 45px;">
</a>
</div>
<p align="center">
<img src="ShadowDumper/Assets/main.jpg" alt="Help" width="600"/>
</p>

Shadow Dumper is a powerful tool used to dump LSASS (Local Security Authority Subsystem Service) memory, often needed in penetration testing and red teaming acti. It offers flexible options to users and uses multiple ad techniques to dump memory, allowing to access sensitive data in LSASS memory.

> [!CAUTION]
> It's important to note that this project is only for educational and research purposes, and any unauthorized use of it could lead to legal consequences.

🚀 Capabilities

Unhooked Injection (Modified Mimikatz Binary) – Utilizes unhooking to inject a modified Mimikatz binary, bypassing EDR hooks and e detection.

Unhooked Injection (Direct Syscalls with MDWD) – Implements direct syscalls for stealthy injection using MDWD, reducing the footprint left behind.

Simple MiniDumpWriteDump API – Executes the straightforward MiniDumpWriteDump API method for standard LSASS memory extraction.

MINIDUMP_CALLBACK_INFORMATION Callbacks – Uses callback functions for custom handling, offering greater control over the dumping process.

Process Forking Technique – Forks the LSASS process, creating a memory clone and a direct access to the target process.

Direct Syscalls with MiniDumpWriteDump – Combines direct syscalls with MiniDumpWriteDump, enhancing stealth by a typical API hooks.

Native Dump with Direct Syscalls (Offline Parsing) – Le direct syscalls to create a native dump with essential streams for offline parsing, perfect for low-noise operations.

🛠️ Build

Clone ShadowDumper repository

Open in Studio 2019 (v142)

C++ Language Standard ISO C++14 Standard or Higher

Download the shellcodes pan.bin and off.bin from [Resource Shellcodes] folder, place them somewhere in your computer and change the path in ShadowDumper.rc file before compiling.

Make sure MASM should be selected. [Right-click on your project in solution explorer, click build dependencies, click build customization and select .masm]

Right click on ASM files and go to properties and make sure item type should be Microsoft Macro Assembler

Compile project

> [!NOTE]
> V1.0 Compatibility: Windows (x64) [Tested with x64 build] on Windows 10 22H2 (OS build 19045.5487) with major 10.0
[You may face issues on latest releases in some methods, this can be due to of mimikatz]

⛑️ Usage

To run ShadowDumper, execute the compiled binary from the powershell.

Default Mode (V1.0)

No Parameter Provided: Show the user friendly console with multiple options to execute

<p align="center">
<img src="ShadowDumper/Assets/display.png" alt="Help" width="600"/>
</p>

Default Mode (V2.0)

No Parameter Provided: Show the user friendly console with multiple options to execute

<p align="center">
<img src="ShadowDumper/Assets/displayv2.png" alt="Help" width="600"/>
</p>

CommandLine Mode (V1.0)

Parameter: -h: Displays a help menu with all a options.

<p align="center">
<img src="ShadowDumper/Assets/help.png" alt="Help" width="600"/>
</p>

CommandLine Mode (V2.0)

Parameter: -h: Displays a help menu with all a options.

<p align="center">
<img src="ShadowDumper/Assets/helpv2.png" alt="Help" width="600"/>
</p>

💫 Demonstration

Demonstrates the working of ShadowDumper (V1.0).

!Demo

Demonstrates the working of ShadowDumper (V2.0).

!Demo

🔄 Upcoming

🤳 Contact

Ha, ideas, or want to collaborate? Reach out to the author for a con, or jump right in and contribute Issues. Let's make something great together!

🙏 Acknowledgment

Took help in nati streams from the Project by Florinel Olteanu called NtDump.

Injected modified mimikatz by Benjamin DELPY called Mimikatz.

项目信息

开发语言：C++

Star 数：588

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。