LSASS Credentials

The Local Security Authority Subsystem Service (LSASS) process manages various security-related functions in Windows, such as user authentication.

LSASS (lsass.exe) is a process that implements many functions of the Local Security Authority (LSA).

When a domain user performs an interactive logon (physically or via RDP) to a computer, the user's credentials get cached in the LSASS Process in order to use Single Sign-On (SSO) when a network logon is required to access services on the domain.

Users authenticating remotely via NTLM or Kerberos authentication will not cache their credentials on the computer unless Kerberos delegation is enabled.

To access the LSASS Process memory to extract credentials, you must have a user account with SeDebugPrivilege on the target Windows computer. Most of the time, this means that you have access to an account with local administrator privileges on the computer.

SeDebugPrivilege gives the ability to inspect and manipulate any process on the system, regardless of ownership or permissions.

There are many, many tools and research on ways an attacker can dump the LSASS process. Dumping LSASS is a much larger topic than what is mentioned here, especially once you look into protections against LSASS dumping and evading EDR.

Regardless, below are a few popular methods that may work on organizations that may not have executed any penetration tests.

secretsdump.py

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux (Attacker)

secretsdump.py <domain/>[username]<:password><@computer> <options>

OPTIONS
-outputfile                 Base Output Filename
-hashes                     Authenticate Using LMHASH:NTHASH
-k                          Use Kerberos Auth From ccache File

Mimikatz

Task Manager

ProcDump