mimikatz

mimikatz 1.0 vient de sortir en version alpha !

Cette nouvelle version n’est pas une révolution de « l’ancien » mimikatz 0.x, mais une rationalisation du fonctionnement de ce dernier (elle m’apporte surtout beaucoup plus de souplesse lors de son écriture en C/C++)

Modules

mimikatz est maintenant organisé autours de modules locaux :

"standard" ; commandes de base
crypto ; Cryptographie et certificats
system ; Gestion système
process ; Manipulation des processus
thread ; Manipulation des threads
service ; Manipulation des services
privilege ; Manipulation des privilèges
winmine; Manipulation du démineur de Windows XP (démonstration)
nogpo ; Pour éviter quelques GPO triviales
samdump ; Dump de SAM offline
inject ; Injecteur de librairies
ts ; Manipulations Terminal Server
divers ; Fonctions diverses trop petites pour s’émanciper

A part pour le module « standard », la séparation du module et de la fonction appelée se fait avec le séparateur ::
Exemple : inject::process lsass.exe sekurlsa.dll

Librairies

Ce n’est pas forcément le plus discret, mais j’aime injecter des librairies

sekurlsa ; manipulation des données de sécurités dans LSASS
klock ; manipulation de bureaux
kelloworld ; libraire à injecter, pour l’exemple

Pilote

Être administrateur n’est pas toujours suffisant, il peut aussi être intéressant de disposer d’un point d’entrée en mode utilisateur.
Un pilote, mimikatz.sys est donc disponible.

pilote mimikatz.sys ; manipulation noyau

Les commandes distantes peuvent être appelées en les précédants d’un :

@ pour les libraires (@ seul clos la connexion à la librairie, et la décharge)
! pour le pilote mimikatz (! seul clos la connexion au pilote)

72 thoughts on “mimikatz”

Pingback: effeciently dumping Windows password hashes « Daniel Weis's I.T Security Blog
Pingback: effeciently dumping Windows password hashes - Daniel Weis - Blogs - Telligent
Pingback: Dis9 Team » Dump Windows password hashes efficiently
Pingback: Mimikatz Contraseñas de Windows « Seguridad y Redes
archenroot on 08/02/2012 at 09:36 said:

Unbeatable tool :), nice work.

Reply ↓
Pingback: Obtener Contraseña Administrador de Windows desde Windows (Sin Hash NTML/LM) « sanchezdiego.com.ar
Pingback: Latino » Blog Archive » Mimikatz Contraseñas de Windows
Carsten on 16/02/2012 at 16:12 said:

Love this tool! Had no idea Windows stored passwords in plaintext, by the way.

Reply ↓
- gentilkiwi on 16/02/2012 at 21:27 said:
  
  Windows don’t store passwords in plaintext, it keep them in memory in reversible way.
  
  Reply ↓
Paul J on 16/02/2012 at 17:07 said:

How did you come about finding the exploit?

Reply ↓
- gentilkiwi on 16/02/2012 at 21:31 said:
  
  This is not an exploit, but a memory trick :)
  Like said in http://blog.gentilkiwi.com/securite/pass-the-pass , found in searching SSO mechanism of Terminal Server, and WDigest
  
  Reply ↓
Pingback: Dumping Cleartext Credentials with Mimikatz « Daniel Weis's I.T Security Blog
Pingback: Dumping Cleartext Credentials with Mimikatz - Daniel Weis - Blogs - Telligent
Pingback: Security News « CyberOperations
pipas on 18/02/2012 at 23:26 said:

Great tool congrats.

Merci pour mimikatz ;)

Reply ↓
Pingback: mimikatz: Tool To Recover Cleartext Passwords From Lsass – Dacheng Luo
Pingback: Jeremiah Grossman, Security News – Episode 278 » 華人資安論壇與資安認知教育網誌
Pingback: FeiFei's Blog » 获取Windows系统明文密码神器
rem7ter on 23/02/2012 at 10:52 said:

Input » ^Z » in mimikatz.exe command, it’s will run always you ctrl-c.

Reply ↓
Pingback: 调试器神器 – mimikatz-获取windows处于active状态账号明文密码[转] | Ｖｉｓｉｏｎ＇ｓ　Ｂｌｏｇ
XFAN on 23/02/2012 at 16:06 said:

very good! thanks ~~~

Reply ↓
piaoye on 24/02/2012 at 01:10 said:

3Q!

Reply ↓
Pingback: 轻量级神器 mimikatz – 直接抓取 Windows 明文密码！ - Firedli's Blog
Sk on 24/02/2012 at 12:49 said:

really an amazing tool! thanks for sharing! nice work!!

Reply ↓
zp on 26/02/2012 at 07:33 said:

ccan i use it on win7?

Reply ↓
- gentilkiwi on 26/02/2012 at 14:15 said:
  
  for sure !
  (don’t forget to run it as administrator ;))
  
  Reply ↓
  - zp on 27/02/2012 at 13:17 said:
    
    thank you i will try it
  - zp on 27/02/2012 at 13:36 said:
    
    i run it as administrator win7 sp1
    but error
    Hints are as follows:
    Demande d’ACTIVATION du privilege: SeDebugPriviliege:OK
    Erreur:Impossible d’injecter !; 拒绝访问
    Erreur:pas ou plus de communication etablie
    
    How so? thank
  - gentilkiwi on 27/02/2012 at 19:59 said:
    
    Send me full console output.
  - zp on 28/02/2012 at 07:41 said:
    
    this is full console output.
    win7 sp1 administrator run it
    
    mimikatz # privilege::debug
    Demande d’ACTIVATION du privilège : SeDebugPrivilege : OK
    
    mimikatz # inject::process lsass.exe sekurlsa.dll
    PROCESSENTRY32(lsass.exe).th32ProcessID = 580
    Erreur : Impossible d’injecter ! ; (0×00000005) 拒绝访问。
    
    mimikatz # @getLogonPasswords
    Erreur : pas ou plus de communication établie
  - gentilkiwi on 22/03/2012 at 00:39 said:
    
    Acces denied come from 360 Safe security functions :)
Pingback: 通杀WIN服务器得明文密码神器
Pingback: Outils, services, sites à (re)découvrir 2012 S08 | La Mare du Gof
BelEtb on 27/02/2012 at 04:02 said:

Great! Thank U.

Reply ↓
william sanoma on 27/02/2012 at 19:20 said:

secpol.msc -> Local Policies -> User Rights Assignments -> Debug Programs
Remove Administrators/System
This is also how you stop Pass-The-hash from working too.
I’ve tried on Win7 and XP SP3 (english) and I get this error on XP
mimikatz # inject::process lsass.exe sekurlsa.dll
PROCESSENTRY32(lsass.exe).th32ProcessID = 640
Erreur : Impossible d’injecter ! ; (0×00000008) Not enough storage is available to process this command.
Same wtih Win7(64-bit) only the hex is different
Erreur : Impossible d’injecter ! ; (0xc0000022) {Access Denied} A process has requested access to an object, but has not been granted those access rights.

Reply ↓
- william sanoma on 27/02/2012 at 19:57 said:
  
  Nevermind :) I was not using the 64-bit (x64) version on my 64-bit OS.
  Also to work around removing the sedebug priv using group policy and or secpol.msc, you can run as system (psexec -s cmd.exe) and everything works well. Very good tool, I hope you make even more additions! (@dumpall would be cool too, dump anything and everything this tool has to offer)
  -william
  
  Reply ↓
- gentilkiwi on 27/02/2012 at 19:58 said:
  
  0×00000008 is from NT 5 RDP session, not because debug right removed ;)
  in both case : psexec -s XXX … no need of debug right, and bypass session isolation in RDP ;)
  
  Reply ↓
Pingback: 轻量级调试器神器 – mimikatz – 直接抓取 Windows 明文密码！
Pingback: 百寞' Blog » Blog Archive » 轻量级调试器神器 – mimikatz – 直接抓取 Windows 明文密码！
Pingback: 转：windows下轻量级调试神器—mimikatz – 2哥博客|H3CIE|网络技术|数据中心|路由交换|网络安全|黑客技术|CCIE|Linux|服务器|wordpress
HEHE on 04/03/2012 at 02:28 said:

You can solve the problem of CreateRemoteThread the
http://www.cnasm.com/view.asp?classid=51&newsid=292

Reply ↓
- gentilkiwi on 04/03/2012 at 02:36 said:
  
  Thank’s !!! I’ve already relied on manual Stack creation and get it worked, but with NT 6, I prefer RtlCreateUserThread :)
  
  Reply ↓
Pingback: 神器mimikatz使用命令方法总结 | Ｖｉｓｉｏｎ＇ｓ　Ｂｌｏｇ
Pingback: mimikatz的使用方法总结 « Crackerban Team
dario90 on 08/03/2012 at 07:11 said:

it’s necessary an english version please

Reply ↓
Pingback: 轻量级调试器神器 – mimikatz – 直接抓取 Windows 明文密码! « x7z|关注网络安全|Web安全|最新0day漏洞|网站安全顾问
dingo9 on 09/03/2012 at 22:51 said:

Isn’t this how Windows can send HTTP-Authentication using IE without prompting for the password? If so, could a program like Firefox, launched as the same user who is logged on, read those credentials and also pass HTTP-authentication without being prompted? This could add functionality to something like FF if this was so, could it not? I mean IE does it…
-mandingo-

Reply ↓
- gentilkiwi on 09/03/2012 at 23:12 said:
  
  In some way yes. But Windows does not need it for Kerberos or NTLM auth. Just for some Digest auth.
  FireFox can use Kerberos and NTLM auth with SSO (see network.negotiate-auth.*), maybe wdigest too ?
  In all case, no need for hack for that, Windows allow « normal » API to obtain responses to challenges.
  
  Reply ↓
  - dingo9 on 09/03/2012 at 23:25 said:
    
    I meant digest-auth. I wonder if FF could read it and then pass it on, or if they choose not to :)
  - gentilkiwi on 10/03/2012 at 00:01 said:
    
    It seems it’s a choice ; SSPI supports wdigest.
    cf. http://technet.microsoft.com/library/cc780455.aspx
Pingback: Unsung Heros (the list) « Cатсн²² (in)sесuяitу / ChrisJohnRiley

C:\Program Files\WinRAR\ts\Win32&gt;mimikatz.exe
mimikatz 1.0 x86 (alpha)        /* Traitement du Kiwi (Feb  9 2012 01:46:57) */
// http://blog.gentilkiwi.com/mimikatz

mimikatz # privilege::debug
Demande d'ACTIVATION du privilège : SeDebugPrivilege : OK

mimikatz # inject::process lsass.exe sekurlsa.dll
PROCESSENTRY32(lsass.exe).th32ProcessID = 452
Erreur : Impossible d'injecter ! ; (0x00000008) 存储空间不足，无法处理此命令。

mimikatz #

help me

Reply ↓

gentilkiwi on 12/03/2012 at 20:56 said:

On NT 5 RDP use psexec -s … (and avoid privilege::debug ;))

Reply ↓

dingo9 on 12/03/2012 at 21:28 said:

FYI, Windows 8 (dev-preview) is working for me so far. Haven’t tried all the commands yet but so far so good. Is there a way to run all commands planned? Maybe output to a single file?
-mandingo-

Reply ↓
- gentilkiwi on 12/03/2012 at 21:46 said:
  
  I’ve some surprises for windows 8 consummer preview :)
  they’re are some problem with the current version, internal is 90% for x64, and 70% x86.
  
  Reply ↓
Pingback: Drunken Security News – Episode 279 » 信息安全播客
Pingback: Tonya Bacam, Security Onion – Episode 279 » 華人資安論壇與資安認知教育網誌
Pingback: Live from CCDC – Episode 280 » 華人資安論壇與資安認知教育網誌
Pingback: Recuperando contraseñas de Windows en texto plano (I de II)
Pingback: 牛X神器-mimikatz | Yoio's Blog
Pingback: 欺天: NLP | HACK | 社会工程学 | 金融
Pingback: Remotely Recovering Windows Passwords in Plain Text « CYBER ARMS – Computer Security
John on 16/04/2012 at 20:04 said:

Is source code available? Thanks

Reply ↓
- gentilkiwi on 16/04/2012 at 22:26 said:
  
  no, but getXXFunctions list all you need…
  
  Reply ↓
Pingback: 轻量级调试器神器 – mimikatz – 直接抓取 Windows 明文密码 | Linglin'S Blog
Pingback: Episode 647 – Quantum Encryption,TriCk, 100 days, Mimikatz, and MySQL DoS | InfoSec Daily
Pingback: Obtener Contraseña Administrador de Windows desde Windows (Sin Hash NTML/LM) | GEEKNOPATAS
Fliego on 22/04/2012 at 18:42 said:

Пополним коллекцию благодарностей на иностранных языках :)
Спасибо!

Reply ↓
Chris on 23/04/2012 at 14:35 said:

Hey, how about a natively english version? I had french in school, but it’s a bit rusty tbh ;)

Reply ↓
Pingback: Pw » 关注互联网技术,专注于信息安全,记录生命点滴故事.
Pingback: Recovering Windows Passwords Remotely in Plain Text | IT Security
Pingback: gentilkiwi @ PHDays 2012 | Blog de Gentil Kiwi

Blog de Gentil Kiwi

L'aide mémoire d'un kiwi