TVT618

[Windows] mimikittenz - A post-exploitation powershell tool

Mar 19th, 2018
99
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.02 KB | None | 0 0
  1. [Windows]
  2. mimikittenz - A post-exploitation powershell tool for extracting juicy info from memory
  3.  
  4. About mimikittenz
  5. mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
  6.  
  7. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns including but not limited to:
  8. * TRACK2 (CreditCard) data from merchant/POS processes
  9. * PII data
  10. * Encryption Keys & All the other goodstuff
  11.  
  12. Note: This tool is targeting running process memory address space, once a process is killed it's memory 'should' be cleaned up and inaccessible however there are some edge cases in which this does not happen.
  13.  
  14. Screenshot
  15.  
  16. Description
  17. The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target.
  18.  
  19. Currently mimikittenz is able to extract the following credentials from memory:
  20. * Webmail: Gmail, Office365, Outlook Web
  21. * Accounting: Xero, MYOB
  22. * Remote Access: Juniper SSL-VPN, Citrix NetScaler, Desktop Web Access 2012
  23. * Developement: Jira, Github, Bugzilla, Zendesk, Cpanel
  24. * IHateReverseEngineers: Malwr, VirusTotal, AnubisLabs
  25. * Misc: Dropbox, Microsoft Onedrive, AWS Web Services, Slack, Twitter, Facebook
  26.  
  27. License: https://creativecommons.org/licenses/by/4.0/
  28.  
  29. Customization
  30. Custom regex - The syntax for adding custom regex is as follows:
  31. [mimikittenz.MemProcInspector]::AddRegex("<NameOfTarget>","<regex_here>")
  32.  
  33. Custom target process - Just append your target proccess name into the array:
  34. [mimikittenz.MemProcInspector]::InspectManyProcs("iexplore","chrome","firefox")
  35.  
  36. Contributions: I'd love to see the list of regex's and target processe's grow in order to build a comprehensive post-exploitaiton hit list.
  37.  
  38. Download: https://github.com/putterpanda/mimikittenz#description
Add Comment
Please, Sign In to add comment