Protected LSASS
Protected LSASS
To enable LSASS protection, we can modify the registry RunAsPPL DWORD value in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa to 1
If the LSA protection is enabled, we will get an error executing the "sekurlsa::logonpasswords" command.
The command returns a 0x00000005 error code message (Access Denied). Lucky for us, Mimikatz provides a mimidrv.sys driver that works on kernel level to disable the LSA protection. We can import it to Mimikatz by executing "!+" as follows,
Once the driver is loaded, we can disable the LSA protection by executing the following Mimikatz command:
Now, if we try to run the "sekurlsa::logonpasswords" command again, it must be executed successfully and show cached credentials in memory.
We can use one-liner
Last updated