rapid7/metasploit-framework — pull request #937 by sempervictus (2012-10-19 23:52:10+00:00)
Title: Mimikatz in-memory excution post module

This module executes mimikatz in memory, parses the output, and stores raw text as well as DB credentials.

The topic is covered in Mubix' blog post (http://www.room362.com/blog/2012/9/6/completely-in-memory-mimikatz-with-metasploit.html), and a PoC module (on-disk, multi-file from older mimikatz revision) made by Hostess (https://github.com/mandreko/metasploit-framework/blob/mimikatz_post/modules/post/windows/gather/mimikatz.rb) over half a year ago.

For those who dont know, mimikatz gets clear-text credentials from windows systems, and now its invisible to AV as well.