LSASS Credentials

The Local Security Authority Subsystem Service (LSASS) process manages various security-related functions in Windows, such as user authentication.

LSASS (lsass.exe) is a process that implements many functions of the Local Storage Authority (LSA).

When a domain user performs an interactive logon (physically or via RDP) to a computer, the user's credentials get cached in the LSASS Process in order to use Single Sign-On (SSO) when network logon is required to access services on the domain.

Users authenticating remotely via NTLM or Kerberos authentication will not cache their credentials on the computer unless Kerberos delegation is enabled.

To access LSASS Process memory to extract credentials, you must have a user account with SeDebugPrivilege to the target Windows computer. Most of the time, this means that you have access to an account with local administrator privileges to the computer.

SeDebugPrivilege is enabled by default in PowerShell and NOT enabled by default in CMD.

There are many, many tools and research on ways an attacker can dump the LSASS process. Dumping LSASS is a much larger topic than what is mentioned here, especially once you look into protections against LSASS dumping and evading EDR.

Regardless, below are a few popular methods that may work on organizations that may not have executed any penetration tests.

secretsdump.py

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux (Attacker)

secretsdump.py <domain/>[username]<:password><@computer> <options>

OPTIONS
-outputfile                 Base Output Filename
-hashes                     Authenticate Using LMHASH:NTHASH
-k                          Use Kerberos Auth From ccache File

Mimikatz

Task Manager

ProcDump