lsass 开源项目推荐（44 个）

fortra /nanodump

LSASS 转储的瑞士军刀

nikaiw /VMkatz

直接从虚拟机内存快照和虚拟磁盘提取Windows凭据

aas-n /spraykatz

Credentials gathering tool automating remote procdump and parse of lsass process.

ricardojoserf /NativeDump

Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

ricardojoserf /TrickDump

仅用NTAPI函数转储lsass，生成3个JSON和1个ZIP文件......之后生成MiniDump文件！

vari-sh /RedTeamGrimoire

🔥📜 Forbidden collection of Red Team sorcery 📜🔥

andreisss /KslDump

KslDump — Why bring your own knife when Defender already left one in the kitchen?

CCob /MirrorDump

Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

kindtime /nosferatu

Windows NTLM Authentication Backdoor

Hagrid29 /DuplicateDump

Dumping LSASS with a duplicated handle from custom LSA plugin

jbaines-r7 /dellicious

Enabled / Disable LSA Protection via BYOVD

Retr0-code /hash-dumper

Windows NTLM hash dump utility written in C language, that supports Windows and Linux. Hashes can be dumped in realtime or from already saved SAM and SYSTEM hives.

TheKingOfDuck /hashdump

Dumping Windows Local Credentials Tools/Tricks

ColeHouston /theHandler-BOF

Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

jkerai1 /WindowsHardeningScripts

Windows Hardening Powershell Scripts

cl4ym0re /sysMiniDumpWD

A lsass dump tool using MiniDumpWriteDump & syscall(NtOpenProcess) technique. only tested on windows 11 with defender enabled:-)

ErenCanOzmn /CredentialGuardBypass

By manipulating LSASS memory flags like UseLogonCredential and IsCredGuardEnabled, this repo demonstrates how Credential Guard can be bypassed—restoring cleartext credentials despite the protection appearing active. Requires SYSTEM-level access and targets VBS-based defenses.

keowu /WinHandKill

A plugin for x64dbg that allows you to hook the Local Security Authority Subsystem Service process to extract all possible TLS(On handshake, Import, Export or Generate) keys from the operating system using the SeDebugPrivilege escalation to make malware analysis faster and easier.

lassehauballe /Shellcode-Minidumpwritedump

Shellcode for creating a minidump file of the lsass.exe process.

zodi4cx /OpenSesame

A bootkit to bypass Windows login (WIP)