# Tool That Extracts Windows Logon Credentials & Dumps Info Without Touching Disk **URL:** \ **Category:** Tools & Scripts\ **Tags:** hacking, trading\ **Created:** [January 11, 2020, 10:14pm UTC](https://onehack.st/t/tool-that-extracts-windows-logon-credentials-dumps-info-without-touching-disk/65761 "2020-01-11T22:14:59Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\ **Post date:** [January 11, 2020, 10:14pm UTC](https://onehack.st/t/tool-that-extracts-windows-logon-credentials-dumps-info-without-touching-disk/65761/1 "2020-01-11T22:14:59Z")
# lsassy - Python library to remotely extract credentials. ![image](https://onehack.st/uploads/default/original/3X/d/9/d95c62d6d003f74dffb903082c7dca0324fc3eed.png) > The way Windows is designed, when it stores passwords, it uses lsass.exe, which is the Local Security Authority Subsystem Service. - So, when you go to your taskbar, and find the process, creating a dump file from it, saving it, contains logon credentials inside. There are various tools like the ones we posted about **mimikaktz** , you could use it on that dump file, **[sekurlsa:logonpasswords](https://github.com/gentilkiwi/mimikatz)**, will dump the password in `plain text`. This technique is used in post exploitation, but using mimikatz touches disk, and **sometimes hackers want to be as silent as possible** , and know that from before, depending on the setup of the target machine, therefore lsassy by HacknDo is a tool that extracts and dumps this info Without touching disk, directly from the memory, using advanced and different ways like procdump, comsvsc.sll, crackmapexec, and extracting credentials from lsass remotely. Blog post : [https://en.hackndo.com/remote-lsass-dump-passwords/](https://en.hackndo.com/remote-lsass-dump-passwords/) This library uses [impacket](https://github.com/SecureAuthCorp/impacket) projects to remotely read necessary bytes in lsass dump and [pypykatz](https://github.com/skelsec/pypykatz) to extract credentials. > # GitHub Link: [https://github.com/blackhatethicalhacking/lsassy](https://github.com/blackhatethicalhacking/lsassy)