{"record":{"id":"ea65209fa37d104f","repo":"shadow1ng/fscan","slug":"minidump-admin-required","errorCode":null,"errorMessage":"minidump_admin_required","messagePattern":"minidump_admin_required","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":99,"sourceCode":"\t\tBasePlugin: plugins.NewBasePlugin(\"minidump\"),\n\t}\n}\n\n// Scan 执行凭据提取——降级链：直接dump → comsvcs.dll → reg save\nfunc (p *MiniDumpPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\t_ = session.Config\n\t_ = session.State\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tsession.LogError(i18n.Tr(\"minidump_panic\", r))\n\t\t}\n\t}()\n\n\tvar output strings.Builder\n\n\t// 检查管理员权限\n\tif !p.isAdmin() {\n\t\treturn &plugins.Result{Success: false, Output: i18n.GetText(\"minidump_admin_required\") + \"\\n\", Error: errors.New(i18n.GetText(\"minidump_admin_required\"))}\n\t}\n\n\tif err := p.loadSystemDLLs(); err != nil {\n\t\treturn &plugins.Result{Success: false, Output: i18n.Tr(\"minidump_load_dll_failed\", err) + \"\\n\", Error: err}\n\t}\n\tdefer p.releaseSystemDLLs()\n\n\tpm := &ProcessManager{kernel32: p.kernel32, dbghelp: p.dbghelp, advapi32: p.advapi32}\n\tavActive := p.isAVBlocking()\n\n\t// 方式1：直接 MiniDumpWriteDump（无杀软时尝试）\n\tif !avActive {\n\t\toutput.WriteString(i18n.GetText(\"minidump_try_direct\") + \"\\n\")\n\t\tif ok := p.tryDirectDump(ctx, pm, &output, session); ok {\n\t\t\treturn &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}\n\t\t}\n\t} else {\n\t\toutput.WriteString(i18n.GetText(\"minidump_av_skip_direct\") + \"\\n\")","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L81-L117","documentation":"The MiniDump plugin needs administrator privileges because dumping lsass.exe requires SeDebugPrivilege. Before doing any work, Scan() checks p.isAdmin() and aborts with a localized 'minidump_admin_required' message. This is an intentional privilege gate, not an unexpected failure.","triggerScenarios":"Running the minidump scan from a non-elevated process on Windows: isAdmin() returns false, so Scan returns a failed Result with Error = errors.New(i18n.GetText(\"minidump_admin_required\")).","commonSituations":"Running the tool from a normal CMD/PowerShell or a service account without elevation; UAC enabled but the process not launched with 'Run as administrator'; running under a restricted CI agent or SSH session.","solutions":["Relaunch the process with administrator privileges (Run as administrator / sudo-equivalent elevation).","If running as a service, configure it to run under LocalSystem or an account with SeDebugPrivilege.","Pre-check privileges with IsWinAdmin / whoami /priv before invoking the scan and fail fast with a clear message.","On hardened hosts, use an alternative credential-dump collection path that does not require lsass access."],"exampleFix":"// before\nres := miniDumpPlugin.Scan(ctx, session)\n// after\nif !isAdmin() {\n    return fmt.Errorf(\"minidump scan requires elevation: relaunch as administrator\")\n}\nres := miniDumpPlugin.Scan(ctx, session)","handlingStrategy":"validation","validationCode":"// Windows pre-check before invoking the plugin\nimport \"golang.org/x/sys/windows\"\nfunc isAdmin() bool {\n    var sid *windows.SID\n    if err := windows.AllocateAndInitializeSid(&windows.SECURITY_NT_AUTHORITY, 2,\n        windows.SECURITY_BUILTIN_DOMAIN_RID, windows.DOMAIN_ALIAS_RID_ADMINS,\n        0, 0, 0, 0, 0, 0, &sid); err != nil {\n        return false\n    }\n    defer windows.FreeSid(sid)\n    token := windows.GetCurrentProcessToken()\n    member, _ := token.IsMember(sid)\n    return member\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, session)\nif !res.Success && res.Error != nil &&\n    strings.Contains(res.Error.Error(), \"minidump_admin_required\") {\n    return fmt.Errorf(\"relaunch the tool elevated to run minidump scans\")\n}","preventionTips":["Check elevation (UAC) status before running lsass-related plugins","Run collection agents as LocalSystem when lsass access is required","Document that minidump features are admin-only in tooling docs"],"tags":["windows","privileges","minidump","lsass"],"backgroundTag":"permission-denied","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}