shadow1ng/fscan · error

minidump_admin_required

Error message

minidump_admin_required

What it means

The MiniDump plugin needs administrator privileges because dumping lsass.exe requires SeDebugPrivilege. Before doing any work, Scan() checks p.isAdmin() and aborts with a localized 'minidump_admin_required' message. This is an intentional privilege gate, not an unexpected failure.

Source

Thrown at plugins/local/minidump.go:99

		BasePlugin: plugins.NewBasePlugin("minidump"),
	}
}

// Scan 执行凭据提取——降级链：直接dump → comsvcs.dll → reg save
func (p *MiniDumpPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	_ = session.Config
	_ = session.State
	defer func() {
		if r := recover(); r != nil {
			session.LogError(i18n.Tr("minidump_panic", r))
		}
	}()

	var output strings.Builder

	// 检查管理员权限
	if !p.isAdmin() {
		return &plugins.Result{Success: false, Output: i18n.GetText("minidump_admin_required") + "\n", Error: errors.New(i18n.GetText("minidump_admin_required"))}
	}

	if err := p.loadSystemDLLs(); err != nil {
		return &plugins.Result{Success: false, Output: i18n.Tr("minidump_load_dll_failed", err) + "\n", Error: err}
	}
	defer p.releaseSystemDLLs()

	pm := &ProcessManager{kernel32: p.kernel32, dbghelp: p.dbghelp, advapi32: p.advapi32}
	avActive := p.isAVBlocking()

	// 方式1：直接 MiniDumpWriteDump（无杀软时尝试）
	if !avActive {
		output.WriteString(i18n.GetText("minidump_try_direct") + "\n")
		if ok := p.tryDirectDump(ctx, pm, &output, session); ok {
			return &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}
		}
	} else {
		output.WriteString(i18n.GetText("minidump_av_skip_direct") + "\n")

View on GitHub (pinned to 95cc12e753)

Solutions

1. Relaunch the process with administrator privileges (Run as administrator / sudo-equivalent elevation).
2. If running as a service, configure it to run under LocalSystem or an account with SeDebugPrivilege.
3. Pre-check privileges with IsWinAdmin / whoami /priv before invoking the scan and fail fast with a clear message.
4. On hardened hosts, use an alternative credential-dump collection path that does not require lsass access.

Example fix

// before
res := miniDumpPlugin.Scan(ctx, session)
// after
if !isAdmin() {
    return fmt.Errorf("minidump scan requires elevation: relaunch as administrator")
}
res := miniDumpPlugin.Scan(ctx, session)

// Windows pre-check before invoking the plugin
import "golang.org/x/sys/windows"
func isAdmin() bool {
    var sid *windows.SID
    if err := windows.AllocateAndInitializeSid(&windows.SECURITY_NT_AUTHORITY, 2,
        windows.SECURITY_BUILTIN_DOMAIN_RID, windows.DOMAIN_ALIAS_RID_ADMINS,
        0, 0, 0, 0, 0, 0, &sid); err != nil {
        return false
    }
    defer windows.FreeSid(sid)
    token := windows.GetCurrentProcessToken()
    member, _ := token.IsMember(sid)
    return member
}

res := plugin.Scan(ctx, session)
if !res.Success && res.Error != nil &&
    strings.Contains(res.Error.Error(), "minidump_admin_required") {
    return fmt.Errorf("relaunch the tool elevated to run minidump scans")
}

When it happens

Trigger: Running the minidump scan from a non-elevated process on Windows: isAdmin() returns false, so Scan returns a failed Result with Error = errors.New(i18n.GetText("minidump_admin_required")).

Common situations: Running the tool from a normal CMD/PowerShell or a service account without elevation; UAC enabled but the process not launched with 'Run as administrator'; running under a restricted CI agent or SSH session.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• minidump_all_methods_failed
• %s [minidump_process_not_found: %s]
• %s: %w [minidump_open_process_token_failed]
• %s: %w [minidump_lookup_privilege_failed]
• %s: %w [minidump_adjust_token_failed]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/ea65209fa37d104f. Report an issue: GitHub.