fortra / nanodump

The swiss army knife of LSASS dumping

Home Page:https://www.coresecurity.com/core-labs/articles/nanodump-red-team-approach-minidumps

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Maybe issue with nanodump -write

ceramic-skate0 opened this issue · comments

REF issue on other repo skelsec/pypykatz#101

I have run into this when using tool.

Let me know what/if any feedback is needed.

restore_signature.sh was run without error on file.

1 Beacon did basically DOS shell with The dump file is too big. please increase DUMP_MAX_SIZE. this occurred on 1 of 2 tests.

commented

You need to increase the DUMP_MAX_SIZE variable, you can find it here.
Then, recompile with make -f Makefile.mingw and try again.

As for the issue regarding pypykatz, I really can't tell you much, why don't you:

  • Dump LSASS using the task manager and see if the error persists with that dump
  • Try with an older version of pypykatz
  • Send (here) the dump to skelsec to help him find the parsing issue (assuming there is one)
commented

Ok I'm closing this, I cannot reproduce the issue with the infinite loop in pypykatz and the DUMP_MAX_SIZE is simple enough to fix.
If you have new information feel free to re-open this.