Home

History

Basics

Modules

• standard
• privilege
• crypto
• sekurlsa
• kerberos
• lsadump
• vault
• token
• event
• ts
• process
• service
• net
• misc
• library mimilib
• driver mimidrv

About me

External resources

Some amazing alternative versions of mimikatz, w00tw00t! 😊

• Meterpreter extension for mimikatz 1.0 by Ben Campbell (https://twitter.com/Meatballs__ / https://github.com/Meatballs1)

  • https://github.com/rapid7/meterpreter/tree/master/source/extensions/mimikatz
  • https://github.com/rapid7/metasploit-framework/tree/master/lib/rex/post/meterpreter/extensions/mimikatz

• DLL reflection in PowerShell by Joseph Bialek (https://twitter.com/JosephBialek / https://github.com/clymb3r)

  • https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz
  • http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1

• Volatility plugin by Francesco Picasso (https://plus.google.com/+francescopicasso / https://code.google.com/p/hotoloti)

  • http://blog.digital-forensics.it/2014/03/et-voila-le-mimikatz-offline.html
  • http://blog.digital-forensics.it/2014/03/mimikatz-offline-addendum_28.html

• Meterpreter extension for mimikatz 2.0 in progress by Oliver Reeves (https://twitter.com/TheColonial / https://github.com/OJ)

  • https://github.com/rapid7/meterpreter/pull/79
  • https://github.com/rapid7/metasploit-framework/pull/3121

Some ressources inspired by my work

• wce (cleartext passwords part) by Hernan Ochoa @ Amplia security (https://twitter.com/hernano / https://twitter.com/AmpliaSecurity)

  • http://www.ampliasecurity.com/research/wcefaq.html
  • http://seclists.org/fulldisclosure/2013/May/226
  • Details here: http://fr.slideshare.net/gentilkiwi/mimikatz-phdays/29

• sessiondump by Steeve Barbeau @ HSC (https://twitter.com/steevebarbeau / https://github.com/steeve85)

  • http://www.hsc.fr/ressources/outils/sessiondump
  • https://github.com/rapid7/metasploit-framework/pull/1750
  • https://github.com/steeve85/metasploit-framework/tree/sessiondump/external/source/meterpreter/source/extensions/sessiondump
  • Details here: core.c