Mimikatz
Mimikatz is both an exploit on Microsoft Windows that extracts passwords stored in memory and software that performs that exploit.[1] It was created by French programmer Benjamin Delpy and is French slang for "cute cats".[1]
History
Benjamin Delpy discovered a flaw in Microsoft Windows that holds both an encrypted copy of a password and a key that can be used to decipher it in memory at the same time.[1] He contacted Microsoft in 2011 to point out the flaw, but Microsoft replied that it would require the machine to be already compromised.[1] Delpy realised that the flaw could be used to gain access to non-compromised machines on a network from a compromised machine.[1]
He released the first version of the software in May 2011 as closed source software.[1]
In September 2011, the exploit was used in the DigiNotar hack.[1]
Russian conference
He spoke about the software at a conference in 2012.[1] Once during the conference, he returned to his room to find a stranger sitting at his laptop.[1] The stranger apologised, saying he was in the wrong room and left.[1] A second man approached him during the conference and demanded he give him copies of his presentation and software on a USB flash drive.[1] Delpy gave him copies.[1]
Delpy felt shaken by his experiences and before he left Russia, he released the source code on GitHub.[1] He felt that those defending against cyberattacks should learn from the code in order to defend against the attack.[1]
Windows updates
In 2013 Microsoft added a feature to Windows 8.1 that would allow turning off the feature that could be exploited.[1] In Windows 10 the feature is turned off by default, but Jake Williams from Rendition Infosec says that it remains effective, either because the system runs an outdated version of Windows, or he can use privilege escalation to gain enough control over the target to turn on the exploitable feature.[1]
Benjamin Delpy has updated the software to cover further exploits than the original.[2]
Use in malware
The Carbanak attack and the cyberattack on the Bundestag used the exploit.[1] The NotPetya and BadRabbit malware used versions of the attack combined with EternalBlue and EternalRomance exploits.[1]
In popular culture
In Mr Robot episode 9 of season 2, Angela Moss uses mimikatz to get her boss's Windows Domain password.[3]
References
- ^ a b c d e f g h i j k l m n o p q r Greenberg, Andy (2017-11-09). "He Perfected a Password-Hacking Tool—Then the Russians Came Calling". Wired. Archived from the original on 2017-11-09. Retrieved 2022-05-21.
- ^ Petters, Jeff (2020-08-24). "What is Mimikatz: The Beginner's Guide". Varonis Systems. Retrieved 2022-05-21.
- ^ Koecher, Ingmar (21 December 2017). "Mr. Robot, Mimikatz and Lateral Movement".
External links
- Implementation by Benjamin Delpy on github
- Implementation of exploit on github
- v
- t
- e
← 2000s | Timeline | 2020s → |
2010 |
|
---|---|
2011 | |
2012 | |
2013 |
|
2014 | |
2015 | |
2016 |
|
2017 | |
2018 | |
2019 |
persistent threats
- Bangladesh Black Hat Hackers
- Bureau 121
- Charming Kitten
- Cozy Bear
- Dark Basin
- DarkMatter
- Elfin Team
- Equation Group
- Fancy Bear
- GOSSIPGIRL (confederation)
- Guccifer 2.0
- Hacking Team
- Helix Kitten
- Iranian Cyber Army
- Lazarus Group (BlueNorOff) (AndAriel)
- NSO Group
- Numbered Panda
- PLA Unit 61398
- PLA Unit 61486
- PLATINUM
- Pranknet
- Red Apollo
- Rocket Kitten
- Stealth Falcon
- Syrian Electronic Army
- Tailored Access Operations
- The Shadow Brokers
- xDedic
- Yemen Cyber Army
- Ryan Ackroyd
- Mustafa Al-Bassam
- Cyber Anakin
- George Hotz
- Guccifer
- Jeremy Hammond
- Kristoffer von Hassel
- Junaid Hussain
- MLT
- Sabu
- Track2
- Topiary
- The Jester
publicly disclosed
- Evercookie (2010)
- iSeeYou (2013)
- Heartbleed (2014)
- Shellshock (2014)
- POODLE (2014)
- Rootpipe (2014)
- Row hammer (2014)
- SS7 vulnerabilities (2014)
- WinShock (2014)
- JASBUG (2015)
- Stagefright (2015)
- DROWN (2016)
- Badlock (2016)
- Dirty COW (2016)
- Cloudbleed (2017)
- Broadcom Wi-Fi (2017)
- EternalBlue (2017)
- DoublePulsar (2017)
- Silent Bob is Silent (2017)
- KRACK (2017)
- ROCA vulnerability (2017)
- BlueBorne (2017)
- Meltdown (2018)
- Spectre (2018)
- EFAIL (2018)
- Exactis (2018)
- Speculative Store Bypass (2018)
- Lazy FP state restore (2018)
- TLBleed (2018)
- SigSpoof (2018)
- Foreshadow (2018)
- Dragonblood (2019)
- Microarchitectural Data Sampling (2019)
- BlueKeep (2019)
- Kr00k (2019)
2010 |
|
---|---|
2011 | |
2012 | |
2013 | |
2014 | |
2015 | |
2016 | |
2017 | |
2018 | |
2019 |
|