rapid7/meterpreter — pull request #9 by Meatballs1 (2013-04-20 11:33:12+00:00)
Title: Mimikatz extension

I've not seen a pull request for the sessiondump extension I had a play with mimikatz to convert it into an extension. It's not ready yet but I have created the pull request to get some discussion going and some feedback as my C foo is weak.

Metasploit code is here: https://github.com/Meatballs1/metasploit-framework/tree/mimikatz_extension but not submitted a pull request so far.

Main issues encountered:
* License - The majority of Mimikatz is Creative Commons Non Commercial (some parts are just Creative Commons). I think this is compatible with MSF but not sure how it sits with commercial offerings (does it need to be excluded?).

* Mimikatz functions tend not to return useful values, but dump everything to wcout. I have redirected the buffer to my own stringbuffer and modified some of the output format to retrieve CSV style responses. CSV format may not be the best way to format this as passwords may contain " , etc?

* Mimikatz is compiled with Unicode strings, lots of testing will probably be required to ensure Unicode characters aren't lost when returned to the user.

* Mimikatz defines the std namespace. This has a small clash with ReflectiveDLLInjection which uses Hash(). Renamed to _Hash()

* Some Mimikatz structures clash with ReflectiveDLLInjection structures. I have prepended ___ to them to mostly avoid this.

So far I have wdigest (the other authentication storages should be relatively straightforward to add as new functions now).

Currently the user cannot run the command twice, without crashing meterpreter, I have to work out how to cleanup or leave it in a nice state between commands.

Also need to work out how to get it to compile in Debug and I have not tested x64...