smb lsassdump command

What it does

Dumps and parses the LSASS remotely over SMB. LSASS dump file will be deleted after command finishes (best effort)

Remarks

Currently only taskscheduler based dumping is supported. The dumper code was taken from lsassy. It's a cool tool, check it out.

Requirements

• A working SMB connection URL with a user that has admin right to the remote machine
• Task scheduler service available
• The same user can read the resulting dump file

Subcommands

None

Switches

• url: SMB connection URL with the LSASS file's path. Please consult the Connection URL section
• --json : Output results in JSON format
• -g or --grep : Output results in greppable format
• -k : Kerberos directory to write tickets there in kirbi and CCACHE format
• --chunksize: Specifies how large each chunk should be read over SMB for the parsing
• -p : Specifies which LSASS packages to parse. Default: all
• -m or --method : Specifies the dump method.
• -o or --outfile : Writes the secrets to the specified file

Examples

• pypykatz smb lsassdump 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102': Dumps and parses the LSASS file and outputs the results to console.