mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
refactor: minidump 实现降级链凭据提取
不再检测到杀软就直接退出,改为三级降级: 1. 直接 MiniDumpWriteDump(无杀软时尝试,15秒超时) 2. comsvcs.dll(系统签名DLL,部分杀软不拦截) 3. reg save SAM/SECURITY/SYSTEM(离线方式,不碰 LSASS) 全部失败才退出,0.2 秒完成不会卡死系统
This commit is contained in:
@@ -648,6 +648,9 @@ systemdservice_success:
|
||||
other: "Systemd service persistence completed: {{.Arg1}} methods succeeded"
|
||||
|
||||
# System info
|
||||
minidump_regsave_success:
|
||||
other: "Registry hive export completed (SAM/SECURITY/SYSTEM)"
|
||||
|
||||
systeminfo_start:
|
||||
other: "Starting system information collection"
|
||||
systeminfo_os:
|
||||
|
||||
@@ -647,6 +647,9 @@ systemdservice_success:
|
||||
other: "系统服务持久化完成: {{.Arg1}}个方法成功"
|
||||
|
||||
# 系统信息
|
||||
minidump_regsave_success:
|
||||
other: "注册表 hive 导出完成 (SAM/SECURITY/SYSTEM)"
|
||||
|
||||
systeminfo_start:
|
||||
other: "开始系统信息收集"
|
||||
systeminfo_os:
|
||||
|
||||
Reference in New Issue
Block a user