Dumping Process Memory with Custom C# Code

Written by on
Hello All,

Introduction

 As a process of learning how to use Windows API and refreshing my knowledge about c# programming. I plan to learn and code some applications in c# leveraging Windows API for learning & developing tools which can be used during red team engagements.

In this post I will share a simple code written in c# leveraging Windows API to dump the process memory for any running process in windows.

Note:- I am not the first person to write such a code. There are many code samples available on the internet.

What is memory dumping ?

Memory dumping is a process in which the content of the memory is stored in a file for analyzing the reason for the crash or it can be useful for extracting sensitive information from the memory of the running process.

One of the use cases for dumping the memory of the process can be to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.

What is Local Security Authority Subsystem Service (LSASS) ?

 Local Security Authority Subsystem Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, creates access tokens, etc.

One of the famous tools for extracting credentials from the LSASS process is Mimikatz and mostly all the av & edr solutions detect the usage of Mimikatz. So it's risky for red teams to run default Mimikatz in the target environment directly which has such products deployed for detection of so-called malicious applications.

Note:- Just replacing few known words from Mimikatz source code can bypass various av & edr solutions.

About the Code

 As mentioned earlier the code is developed in C# and I have leveraged Windows API MiniDumpWriteDump function of Dbghelp.dll, Dbgcore.dll for dumping the memory of the running process. There are various types of MiniDump, but in this code I am using MiniDumpWithFullMemory type for dumping the memory of the running process.


The complete code can be found here

Demo

1) Compiling the application
The application needs to be build based on the specific windows system architecture on which you need to dump the memory of the running process.
I will be using this tool on a 64 bit system, hence I have compiled this application with a 64 bit configuration setting.


2) Dumping the memory of the process running with user privilege.
The application can dump process memory based on the process name or process id. To view the help section the application should be executed without any arguments.


Dumping notepad process memory using the process name as the argument.


Dumping notepad process memory using the process id as the argument.


3) Dumping the memory of the process running with a system privilege.
The application needs to be executed under high integrity to dump memory of the process running with system privileges.


4) Using Mimikatz to extract credentials from the lsass dump.


Detection

Monitor process loading Dbghelp.dll, Dbgcore.dll DLL's and MiniDumpWriteDump function call.


References

 https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
https://blogs.msdn.microsoft.com/dondu/2010/10/24/writing-minidumps-in-c/
https://github.com/GhostPack/SharpDump

Thanks for reading the post.

Special thanks to all my friends who help / supported / motivated me for writing blogs. 🙏



Comments

Post a Comment

Popular posts from this blog

Information Disclosure - Internal Path Disclosure (PHPWCMS) - CVE-2018-12990

Written by on
Image
Hello All, ​INTRODUCTION T​he  purpose  of this post is to let you know how I managed to get one more CVE​. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability. ​Alright, lets plunge into the Proof-Of-Concept ! ​ PATH OF EXPLORATION ​ After submitting the first vulnerability (Stored Cross Site Scripting) to the developer for phpwcms application I continued to test further for finding more vulnerability. While testing I saw that CSRF Token was submitted in all the request. I tried to tamper with the parameter which contained the CSRF Token and found that the application throws an error which discloses the Internal Path of the application where it has been hosted. THE MOST AWAITED DEEP DIVE POC​ 1) While submitting the profile page request I saw that the application passes one parameter (csrf_token_value) which as per the name suggest contains the csrf token as you can refer the below screenshot.
Read more

Introduction to Callidus

Written by on
Image
Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage
Read more

Process Injection - Part I

Written by on
Image
Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ?
Read more