physmem2profit - Physmem2profit can be used to create a minidump of

项目说明

Physmem2profit

Physmem2profit can be used to create a minidump of a target host's LSASS process by analysing physical memory remotely. The intention of this research is to propose an alternati to credential theft and create a modular framework that can be extended to support other drivers that can access physical memory. Physmem2profit generates a minidump (.dmp) of LSASS that can be further analyzed with Mimikatz. The tool does not require Cobalt Strike but should work fine o with a SOCKS proxy.

The idea is illustrated below:

!O of Physmem2profit

The tool has two components:

1. The C# ser, physmem2profit.exe, executed on the target host
* Loads the Winpmem driver and acts as a server, which exposes the physical RAM of the target host through a TCP port
1. The client, physmem2profit Python module, executed on the attacking machine
* When executed with --mode mount, connects to the target machine and mounts the physical RAM of the target as a raw file with the help of FUSE
* When executed with --mode dump, calls Rekall plugins to analyze the memory image and to generate a minidump of the LSASS process.
* When executed with --mode all, performs both of the abo. Connection with server will be closed when dump is complete.

Installation Instructions

1. Clone the Physmem2profit Git repository: git clone --recurse-submodules
1. For the ser on the target computer:
1. Build physmem2profit/ser.sln with Studio
1. For the client running on the attacking machine:
1. bash physmem2profit/client/install.sh

Usage

1. Run physmem2profit.exe [--ip IP] [-p PORT] [--hidden] [--] on the target as admin.
* You can download the signed Winpmem driver here. This dri to be present on the target host.
1. Run source physmem2profit/client/.env/bin/activate on the attacking machine. This command will activate the created by install.sh.
1. Run cd physmem2profit/client and on the attacking machine
* physmem2profit.exe needs to be running on the target machine before you run this command.
* This will write the LSASS minidump to output/[label]-[date]-lsass.dmp on the attacking machine.
1. Copy the minidump to a Windows system and run mimikatz.exe "sekurlsa::minidump [label]-[date]-lsass.dmp" "sekurlsa::logonpasswords" "exit"

Credential Guard

Decrypting credentials protected by Credential Guard requires gaining access to the encryption key that is stored in the Secure World. For testing purposes, Physmem2profit supports retrieving data from the Secure World from Fusion/Workstation snapshots (.vmem files). This allows credentials protected by Credential Guard to be decrypted with the help of Mimikatz.

Setting up a machine for testing

1. Create a Windows 10 machine with Fusion/Workstation. Join the machine to a domain (Credential Guard does not protect local accounts)
1. In the Ad settings, Enable VBS ( Based Security)
1. Deploy Credential Guard. An easy option is to use the Device Guard and Credential Guard hardware readiness tool
1. Reboot
1. Run msinfo32 to ensure security Services Running says Credential Guard

Testing

1. Log in to the machine (with a domain account)
1. Take a snapshot
1. Run Physmem2profit against the .vmem file:
* This will write the LSASS minidump to output/[label]-[date]-lsass.dmp. The minidump contains a special stream that holds the data from the Secure World, allowing Mimikatz to locate the encryption key.
* The Secure World data is also stored to output/[label]-[date]-secure-world.raw.
* If Rekall has problems parsing the .vmem file, Physmem2profit will recommend you to copy the .vmsn file and rename it to .vmss
1. Copy the minidump to a Windows system and run mimikatz.exe "sekurlsa::minidump [label]-[date]-lsass.dmp" "sekurlsa::logonpasswords" "exit"

Future work

The support for bypassing Credential Guard by exploiting the S3 Resume firmware , demonstated in our Disobey talk, is coming soon :).

More Information

Rethinking Credential Theft | a blog post explaining why this approach to credential theft was chosen.

Physmem2profit is de by and .

Kudos for contributing:
* Janusz Szmigielski for refactoring the code for the first release
* Pawel Kurowski for refactoring the code for the first release
* Grzegorz Rychlik for refactoring the code for the first release

项目信息

开发语言：C#

Star 数：422

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。