Commit Graph

134 Commits

Author SHA1 Message Date
Benjamin DELPY
58a73be753 lsadump::netsync to ask a DC to send current and previous NTLM hash of DC/SRV/WKS
Lots of thanks to @asolino for his help!
2016-05-25 00:18:52 +02:00
Benjamin DELPY
4c6ffa99c5 [fix #39] Removing 2 bytes of alignment when using LSAIso with MSV 2016-05-22 20:07:50 +02:00
Benjamin DELPY
d02a197734 [fix #36] Replace wcsicmp by _wcsicmp to avoid warnings with moderns VS 2016-05-06 23:43:59 +02:00
Benjamin DELPY
81594553f7 New SID module
[remove] misc::addsid
[new] sid:: module, to lookup, query, modify, add... (2003/2008r2/2012r2 right now)
2016-05-06 01:31:04 +02:00
Benjamin DELPY
ea52c92cec [close #35] DCSync works with renamed domains
Thanks to @rmbolger & @MichaelGrafnetter, DCSync now deals with msDS-ReplicationEpoch / dwReplEpoch
2016-05-01 01:30:04 +02:00
Benjamin DELPY
9e298f16e4 Welcom to Windows 10 LTSB & current
[remove] mimidrv & mimikatz kernel module: Process & Object callbacks remover are not anymore in the program
[internal] Windows 10 is now splitted in 1507 (LTSB) and 1511 (current)
[internal] mimidrv: Windows 10 support added
[internal] mimilib WinDBG module & mimikatz::sekurlsa: Windows 10 MSV / Kerberos Tickets are not specific anymore (offsets table)
[internal] Using KULL_M_MEMORY_GLOBAL_OWN_HANDLE instead of local variable in each function
2016-03-27 19:22:36 +02:00
Benjamin DELPY
c1c1608ca8 System Environment Variables & other stuff
[new] System Environment Variables user module
[new] System Environment Variables kernel IOCTL for Set
[enhancement] privilege::sysenv
[enhancement] Busylight
[enhancement] misc::skeleton can avoid anti-AES patching for aware clients with /letaes
2016-02-29 03:11:25 +01:00
Benjamin DELPY
5b72f2a31a Crypto & René Coty
[new] crypto::certificates /silent & /nokey flags
[new] crypto::keys /silent flag
[new] kull_m_busylight module now support protocol for new devices
2016-02-17 00:14:18 +01:00
Benjamin DELPY
e15b0ca68a Some DPAPI stuff
- [new] vault module now handles more Vault types, Attributes and Properties (with /attributes)
- [new] misc::compressme to create a compressed version of mimikatz
- [new] dpapi::cred now handles legacy (NT5) multiple credentials
- [new] dpapi::wifi & dpapi::wwan to deal with network profiles
- [internal] kuhl_m_vault: vault::list now deals with SID / credentials attributes (with one incorrect align.)
- [internal] kull_m_string: removed unused kull_m_string_suspectUnicodeStringStructure
- [internal] kull_m_string: added kull_m_string_printSuspectUnicodeString
- [internal] kull_m_string: added dirty kull_m_string_quickxml_simplefind
- [internal] kull_m_memory: quick compress & decompress routines
- [internal] kull_m_dpapi: added blob flags descriptions
- [internal] kull_m_dpapi: fixed blob protection flags description for system
- [internal] kull_m_dpapi: removed unused kull_m_dpapi_unprotect_backupkey_with_secret
- [internal] kull_m_cred: added legacy (NT5) credentials structures & routines
2016-02-08 01:41:26 +01:00
Benjamin DELPY
f114a779e3 Lots of internals and 2003 SP1 support
- [new] sekurlsa module and its kerberos submodule now work with old 2003 SP1 (live or dump)
- [remove] misc::wifi with WLanAPI will be replaced with dpapi::wifi raw access
- [fix] crypto::certificate buffer free at the right place
- [internal] new kull_m_file Find function with callback
- [internal] removed kull_m_file functions (read/write/file exist) with environment-variables, now used for all command-lines
- [internal] kull_m_crypto_hash better checks for CRC32 trick
- [internal] mimilove for Windows 2000 banner update
- [internal] crypto::system now works with buffers (for future registry access)
- [internal] kerberos::ptt & crypto::system call kull_m_file_Find instead of their own implementation
- [internal] remove CrtlHandler, from mimikatz main modules, when exiting to let PowerShell clean
- [internal] expand command lines environment-variables from mimikatz main modules
2016-01-31 16:01:45 +01:00
Benjamin DELPY
111b47a67b Crypto, crypto everywhere...
[new] crypto::providers and crypto::certificates now list provider types
[internal] Removed kull_m_crypto_crc32 routine from crypto module, relies now on cryptdll using CALG_CRC32 with kull_m_crypto_hash
[internal] Removed incorrect usage of BOOL instead of NTSTATUS in kuhl_m_pac_validationInfo_to_PAC
2016-01-17 00:36:41 +01:00
Benjamin DELPY
34d1d0f573 Crypto & Kerberos enhancements
- [fix] dpapi::capi now deals with AT_SIGNATURE keys
- [fix] sekurlsa::kerberos / kerberos:: encryption type are now signed
- [new] kerberos::ask to ask / save TGS from current TGT
- [new] crypto::system to describe/to export Windows System Certificate (cert, crl, ctl, keyid)
- [internal] smaller banner for smaller displays
- [internal] Copyrights for 2016
- [internal] kull_m_file can deal with environment-variable strings in paths
- [internal] kull_m_crypto new types for CERT_PROP_*_ID
2016-01-12 03:13:12 +01:00
Benjamin DELPY
fbb32cdcfa MSV & Kerberos fixes, LSA and Privilege enhancements
- [fix] sekurlsa::msv & mimilib for Windows 10 build 10586
- [fix #20] sekurlsa::tickets (display & export) for NT 6 != Windows 10
- [close #16] kerberos::golden now with ~NetBios name in LogonDomainName field of the PAC
- [new] privilege module shortcuts (driver, security, tcb, backup, restore) and functions (by id or name)
- [new] lsadump::dcsync and lsadump::lsa /inject 'NTLM-Strong-NTOWF' in Supplemental Credentials structures (Windows 2016 TP 4)
- [internal] NtSetSystemInformation can now be used in code
2016-01-06 02:46:28 +01:00
Benjamin DELPY
1b130574ed mimikatz & mimilib sekurlsa module ready for Windows 10 build 10586 2015-11-13 00:47:56 +01:00
Benjamin DELPY
71015c7081 mimikatz: updated to build with hid.lib 2015-11-09 23:45:49 +01:00
Benjamin DELPY
2576d59c8b Kiwi & René Coty BusyLight mode 2015-10-09 00:40:50 +02:00
Benjamin DELPY
5d20400f6c mimikatz + mimilib sekurlsa fix for SmartCard informations 2015-10-05 01:08:45 +02:00
Benjamin DELPY
42993f5102 sekurlsa::kerberos - Fix SmartCard pin code 2015-09-30 00:40:32 +02:00
Benjamin DELPY
76e68a5f23 sekurlsa::pth Auto-impersonation (/impersonate) 2015-09-27 00:21:58 +02:00
Benjamin DELPY
91b3957211 lsadump::dcsync fix for with 2012r2 AD Recycle Bin
Thank you to @asolino, @mubix & @carnal0wnage !
2015-09-16 22:19:19 +02:00
Benjamin DELPY
5f12ced3fb Enhancements
* Code cleaning
2015-09-06 19:34:30 +02:00
Benjamin DELPY
bea89c67e4 kerberos::golden : fix for groups printing. 2015-09-02 01:30:12 +02:00
Benjamin DELPY
ecf3fd5289 lsadump::dcsync autoselect a domain controller with Directory Service (DIRECTORY_SERVICE) 2015-09-02 01:00:45 +02:00
Benjamin DELPY
c322dc582f Cleaning & few Win10 adaptations 2015-08-30 22:01:05 +02:00
Benjamin DELPY
a2d50caa83 Licence fix on one missed file by AnkhSVN ;) 2015-08-25 11:24:53 +02:00
Benjamin DELPY
8b8eaf0201 Global licence update, credits to Vincent LE TOUX for DCSync, and lsadump::hash moved to crypto::hash 2015-08-25 11:19:01 +02:00
Benjamin DELPY
ae041e0ece lsadump::dcsync - XP and 2003 don't allow QueryContextAttributes for SECPKG_ATTR_SESSION_KEY when using NTLM protocol in userland, forcing Kerberos instead (Negociate otherwise).
Thanks @asolino for letting me show!
2015-08-24 12:21:52 +02:00
Benjamin DELPY
b2687e3085 DRSR error printing 2015-08-24 01:57:20 +02:00
Benjamin DELPY
bdab94dfff DRSR fixes 2015-08-23 22:50:21 +02:00
Benjamin DELPY
a3c105af16 lsadump::dcsync and net::user updates 2015-08-17 00:18:04 +02:00
Benjamin DELPY
9c21b2f70d lsadump::dcsync cleaning (it frees the memory!), and domain autodetect 2015-08-13 01:11:27 +02:00
Benjamin DELPY
7717b7a717 DCSync in mimikatz & for XP/2003 2015-08-11 01:27:13 +02:00
Benjamin DELPY
19425cc81c WDigest for Windows 10 & lsadump::trust fix 2015-08-09 00:57:56 +02:00
Benjamin DELPY
f7c4ccbe3f Fix on normal DPAPI unprotect 2015-07-29 01:10:48 +02:00
Benjamin DELPY
10c317014e Fix for newling in fgetws 2015-07-26 22:30:42 +02:00
Benjamin DELPY
e6924b75ed Compatible with Visual Studio 2015 2015-07-24 00:20:34 +02:00
Benjamin DELPY
c00b9cfab3 DPAPI vault IV for @dfirfpi 2015-07-21 04:11:25 +02:00
Benjamin DELPY
1265e86bfe README update for VS 2013 Express + user32.lib for mimilove 2015-07-19 17:10:43 +02:00
Benjamin DELPY
f686a7400d mimilove DC support (large table handle instead of small) 2015-07-19 15:15:31 +02:00
Benjamin DELPY
9bac6378c6 mimilove for Windows 2000 <3 2015-07-19 02:34:06 +02:00
Benjamin DELPY
5084e9d803 Thanks to @dfirfpi new samples, some cool adaptations! 2015-07-16 01:19:48 +02:00
Benjamin DELPY
f527ec2297 Removed unused var 'j' :) 2015-07-15 01:15:28 +02:00
Benjamin DELPY
3172c1dc23 DPAPI credentials (legacy & vault) 2015-07-15 01:13:21 +02:00
Benjamin DELPY
6aa1836e41 Kerberos tickets with External SID 2015-06-29 00:37:49 +02:00
Benjamin DELPY
67f7f8c466 DPAPI oe auto provisioning & DPAPI_SYSTEM memory reading 2015-06-26 01:22:02 +02:00
Benjamin DELPY
5766e29f33 DPAPI oe starting 2015-06-22 01:31:26 +02:00
Benjamin DELPY
81b9af79ef Unprotect CNG & CAPI from all keys 2015-06-19 01:19:01 +02:00
Benjamin DELPY
c622d6ae42 Fix on key export 2015-06-18 02:21:33 +02:00
Benjamin DELPY
841deedbf8 DPAPI for CAPI & CNG 2015-06-18 02:18:17 +02:00
Benjamin DELPY
bcac477384 DPAPI Masterkeys (normal, backup, domain) 2015-06-14 02:46:21 +02:00