Reply to thread

Message

<blockquote data-quote="Eddie Morra" data-source="post: 770287">The &quot;The 0x00000005&quot; error code being mentioned in that article is the Win32 error code for &quot;Access Denied&quot;, it is converted to Win32 error code from NTSTATUS STATUS_ACCESS_DENIED (0xC0000022).Basically since the lsass.exe process is now a protected process, handle acquisition is being denied system-wide. NtOpenProcess -&gt; calls PsLookupProcessByProcessId to make sure the process exists -&gt; then moves to Psp* if I remember correctly.I&#039;ll have to check ntoskrnl.exe tomorrow and then I&#039;ll let you know the whole process of NtOpenProcess internally.But basically the Windows kernel checks the opaque structures and see&#039;s that lsass.exe is actually set as a protected process so it blocks the operation and the caller is notified that the access to the process was denied.Without that process handle, Mimikatz cannot access or modify the virtual memory of lsass.exe remotely unless it has an exploit to bypass the protection.</blockquote>

[QUOTE="Eddie Morra, post: 770287"] The "The 0x00000005" error code being mentioned in that article is the Win32 error code for "Access Denied", it is converted to Win32 error code from NTSTATUS STATUS_ACCESS_DENIED (0xC0000022). Basically since the lsass.exe process is now a protected process, handle acquisition is being denied system-wide. NtOpenProcess -> calls PsLookupProcessByProcessId to make sure the process exists -> then moves to Psp* if I remember correctly. I'll have to check ntoskrnl.exe tomorrow and then I'll let you know the whole process of NtOpenProcess internally. But basically the Windows kernel checks the opaque structures and see's that lsass.exe is actually set as a protected process so it blocks the operation and the caller is notified that the access to the process was denied. Without that process handle, Mimikatz cannot access or modify the virtual memory of lsass.exe remotely unless it has an exploit to bypass the protection. [/QUOTE]

Verification