Benjamin DELPY
58a73be753
lsadump::netsync to ask a DC to send current and previous NTLM hash of DC/SRV/WKS
...
Lots of thanks to @asolino for his help!
2016-05-25 00:18:52 +02:00
Benjamin DELPY
c1c1608ca8
System Environment Variables & other stuff
...
[new] System Environment Variables user module
[new] System Environment Variables kernel IOCTL for Set
[enhancement] privilege::sysenv
[enhancement] Busylight
[enhancement] misc::skeleton can avoid anti-AES patching for aware clients with /letaes
2016-02-29 03:11:25 +01:00
Benjamin DELPY
e15b0ca68a
Some DPAPI stuff
...
- [new] vault module now handles more Vault types, Attributes and Properties (with /attributes)
- [new] misc::compressme to create a compressed version of mimikatz
- [new] dpapi::cred now handles legacy (NT5) multiple credentials
- [new] dpapi::wifi & dpapi::wwan to deal with network profiles
- [internal] kuhl_m_vault: vault::list now deals with SID / credentials attributes (with one incorrect align.)
- [internal] kull_m_string: removed unused kull_m_string_suspectUnicodeStringStructure
- [internal] kull_m_string: added kull_m_string_printSuspectUnicodeString
- [internal] kull_m_string: added dirty kull_m_string_quickxml_simplefind
- [internal] kull_m_memory: quick compress & decompress routines
- [internal] kull_m_dpapi: added blob flags descriptions
- [internal] kull_m_dpapi: fixed blob protection flags description for system
- [internal] kull_m_dpapi: removed unused kull_m_dpapi_unprotect_backupkey_with_secret
- [internal] kull_m_cred: added legacy (NT5) credentials structures & routines
2016-02-08 01:41:26 +01:00
Benjamin DELPY
fbb32cdcfa
MSV & Kerberos fixes, LSA and Privilege enhancements
...
- [fix] sekurlsa::msv & mimilib for Windows 10 build 10586
- [fix #20 ] sekurlsa::tickets (display & export) for NT 6 != Windows 10
- [close #16 ] kerberos::golden now with ~NetBios name in LogonDomainName field of the PAC
- [new] privilege module shortcuts (driver, security, tcb, backup, restore) and functions (by id or name)
- [new] lsadump::dcsync and lsadump::lsa /inject 'NTLM-Strong-NTOWF' in Supplemental Credentials structures (Windows 2016 TP 4)
- [internal] NtSetSystemInformation can now be used in code
2016-01-06 02:46:28 +01:00
Benjamin DELPY
71015c7081
mimikatz: updated to build with hid.lib
2015-11-09 23:45:49 +01:00
Benjamin DELPY
9bac6378c6
mimilove for Windows 2000 <3
2015-07-19 02:34:06 +02:00
Benjamin DELPY
627041252b
DPAPI Backup keys export
2015-05-23 23:49:04 +02:00
Benjamin DELPY
c85332baba
minor file function change
2015-01-13 22:08:23 +01:00
Benjamin DELPY
baf7785c9e
ntdll.min.lib adjusted for RtlAnsiStringToUnicodeString
2014-11-21 00:18:57 +01:00
Benjamin DELPY
5d191619fc
Microsoft BlueHat edition
...
Windows 10 Technical Preview inside, but some kernel parts are missing
2014-10-10 01:53:03 -07:00
Benjamin DELPY
21f1e25cc9
x64 srv lib no more needed
2014-05-25 21:40:31 +02:00
Benjamin DELPY
54502be4ca
lsadump::lsa can play with AD supplementalCredentials, with mimilib.dll
2014-05-24 22:16:46 +02:00
Benjamin DELPY
bb371c2acb
Initial upload
2014-04-06 20:31:53 +02:00
