Pure-Go credential-extraction primitives for Windows: live LSASS
process dumping, offline SAM hive parsing, in-process MINIDUMP
parsing, and Kerberos ticket forging. The four packages chain
end-to-end — lsassdump produces a dump, sekurlsa parses it
into typed credentials, goldenticket re-uses an extracted
krbtgt hash to mint a Golden TGT, and samdump covers the
local-account branch when LSASS access is unavailable.
flowchart LR
subgraph host [Live Windows host]
L[lsass.exe<br>memory]
S[SYSTEM + SAM<br>hives]
K[krbtgt key<br>on a DC]
end
subgraph extract [credentials/*]
LD[lsassdump<br>NtReadVirtualMemory<br>+ in-process MINIDUMP<br>+ optional PPL bypass]
SE[sekurlsa<br>parse MINIDUMP<br>walk MSV / Wdigest /<br>Kerberos / DPAPI / TSPkg /<br>CloudAP / LiveSSP / CredMan]
SD[samdump<br>REGF parser<br>+ syskey / hashed bootkey<br>+ AES/RC4/DES decrypt]
end
subgraph forge [credentials/*]
GT[goldenticket<br>Forge + Submit]
end
L --> LD
LD --> SE
S --> SD
K --> SE
SE -.krbtgt hash.-> GT
SD --> OUT[NTLM hashes / pwdump]
SE --> OUT2[NTLM / Kerberos / DPAPI<br>/ CloudAP PRT / etc.]
GT --> KIRBI[kirbi blob<br>+ LSA cache inject]