Extraindo Credenciais de um Dump de Memória

Quando Usar

• Durante a resposta a incidentes para determinar a quais credenciais um atacante teve acesso
• Ao avaliar o escopo do comprometimento de credenciais após uma violação
• Para identificar contas que precisam de redefinição de senha imediata
• Ao investigar movimento lateral e ataques pass-the-hash/pass-the-ticket
• Para recuperar chaves de criptografia ou tokens de autenticação da memória de processos

Pré-requisitos

• Dump de memória em formato raw, ELF ou crash dump
• Volatility 3 com tabelas de símbolos do Windows
• Mimikatz (para análise offline de dumps LSASS extraídos)
• pypykatz (implementação Python do Mimikatz para análise baseada em Linux)
• Compreensão da autenticação do Windows (NTLM, Kerberos, DPAPI)
• Autorização legal apropriada para extração de credenciais

Fluxo de Trabalho

Etapa 1: Preparar Ferramentas e Verificar o Dump de Memória

# Install analysis tools
pip install volatility3 pypykatz

# Verify memory dump integrity
sha256sum /cases/case-2024-001/memory/memory.raw

# Identify the OS version
vol -f /cases/case-2024-001/memory/memory.raw windows.info

# Verify LSASS process exists in memory
vol -f /cases/case-2024-001/memory/memory.raw windows.pslist | grep -i lsass

# Output:
# PID    PPID   ImageFileName   Offset(V)        Threads  Handles  SessionId
# 684    564    lsass.exe       0xffffe00123456   35       1234     0

Etapa 2: Extrair Hashes de Credenciais com Volatility

# Dump SAM database hashes from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.hashdump \
   | tee /cases/case-2024-001/analysis/hashdump.txt

# Output format:
# User           RID    LM Hash                          NTLM Hash
# Administrator  500    aad3b435b51404eeaad3b435b51404ee  fc525c9683e8fe067095ba2ddc971889
# Guest          501    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0
# DefaultAccount 503    aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0
# svcbackup      1001   aad3b435b51404eeaad3b435b51404ee  2b576acbe6bcfda7294d6bd18041b8fe

# Extract LSA secrets
vol -f /cases/case-2024-001/memory/memory.raw windows.lsadump \
   | tee /cases/case-2024-001/analysis/lsadump.txt

# Extract cached domain credentials
vol -f /cases/case-2024-001/memory/memory.raw windows.cachedump \
   | tee /cases/case-2024-001/analysis/cachedump.txt

Etapa 3: Dump da Memória do Processo LSASS para Análise Detalhada

# Dump LSASS process memory (PID from Step 1)
vol -f /cases/case-2024-001/memory/memory.raw windows.memmap --pid 684 --dump \
   -o /cases/case-2024-001/analysis/lsass_dump/

# Alternative: Dump all files associated with LSASS
vol -f /cases/case-2024-001/memory/memory.raw windows.dumpfiles --pid 684 \
   -o /cases/case-2024-001/analysis/lsass_files/

# Use procdump plugin for cleaner process dump
vol -f /cases/case-2024-001/memory/memory.raw windows.dumpfiles \
   --pid 684 -o /cases/case-2024-001/analysis/

# Rename the dump file for pypykatz/mimikatz
mv /cases/case-2024-001/analysis/lsass_dump/pid.684.dmp \
   /cases/case-2024-001/analysis/lsass.dmp

Etapa 4: Extrair Credenciais com pypykatz

# Executa o pypykatz contra o dump de memória completo
pypykatz lsa minidump /cases/case-2024-001/analysis/lsass.dmp \
   > /cases/case-2024-001/analysis/pypykatz_results.txt 2>&1

# Executa o pypykatz contra o dump de memória raw diretamente
pypykatz rekall /cases/case-2024-001/memory/memory.raw \
   > /cases/case-2024-001/analysis/pypykatz_full.txt 2>&1

# Analisa a saída do pypykatz para análise estruturada
python3 << 'PYEOF'
import json

# pypykatz também pode gerar saída JSON
import subprocess
result = subprocess.run(
    ['pypykatz', 'lsa', 'minidump', '/cases/case-2024-001/analysis/lsass.dmp', '-j'],
    capture_output=True, text=True
)

if result.stdout:
    data = json.loads(result.stdout)

    print("=== CREDENCIAIS EXTRAÍDAS ===\n")

    for session_key, session in data.get('logon_sessions', {}).items():
        username = session.get('username', 'Unknown')
        domain = session.get('domainname', '')
        logon_server = session.get('logon_server', '')
        logon_time = session.get('logon_time', '')
        sid = session.get('sid', '')

        if username and username != '(null)':
            print(f"Sessão: {domain}\\{username}")
            print(f"  SID: {sid}")
            print(f"  Servidor de Logon: {logon_server}")
            print(f"  Hora de Logon: {logon_time}")

            # Hashes NTLM
            msv = session.get('msv_creds', [])

…