-
Notifications
You must be signed in to change notification settings - Fork 212
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Showing
77 changed files
with
2,300 additions
and
1,643 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| /* Benjamin DELPY `gentilkiwi` | ||
| http://blog.gentilkiwi.com | ||
| https://blog.gentilkiwi.com | ||
| [email protected] | ||
| Licence : https://creativecommons.org/licenses/by/4.0/ | ||
| */ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| /* Benjamin DELPY `gentilkiwi` | ||
| http://blog.gentilkiwi.com | ||
| https://blog.gentilkiwi.com | ||
| [email protected] | ||
| Licence : https://creativecommons.org/licenses/by/4.0/ | ||
| */ | ||
|
|
@@ -22,29 +22,18 @@ int wmain(int argc, wchar_t * argv[]) | |
| { | ||
| NTSTATUS status = STATUS_SUCCESS; | ||
| int i; | ||
| #ifndef _WINDLL | ||
| #if !defined(_POWERKATZ) | ||
| size_t len; | ||
| wchar_t input[0xffff]; | ||
| kull_m_output_init(); | ||
| SetConsoleTitle(MIMIKATZ L" " MIMIKATZ_VERSION L" " MIMIKATZ_ARCH L" (oe.eo)"); | ||
| SetConsoleCtrlHandler(HandlerRoutine, TRUE); | ||
| #endif | ||
| kprintf(L"\n" | ||
| L" ___ _ " MIMIKATZ_FULL L"\n" | ||
| L" / ('>- " MIMIKATZ_SECOND L"\n" | ||
| L" | K | /* * *\n" | ||
| L" \\____/ Benjamin DELPY `gentilkiwi` ( [email protected] )\n" | ||
| L" L\\_ http://blog.gentilkiwi.com/kekeo (oe.eo)\n" | ||
| L" " MIMIKATZ_SPECIAL L" with %2u modules * * */\n", ARRAYSIZE(mimikatz_modules)); | ||
|
|
||
| mimikatz_initOrClean(TRUE); | ||
| mimikatz_begin(); | ||
| for(i = MIMIKATZ_AUTO_COMMAND_START ; (i < argc) && (status != STATUS_FATAL_APP_EXIT) ; i++) | ||
| { | ||
| kprintf(L"\n" MIMIKATZ L"(" MIMIKATZ_AUTO_COMMAND_STRING L") # %s\n", argv[i]); | ||
| status = mimikatz_dispatchCommand(argv[i]); | ||
| } | ||
| #ifndef _WINDLL | ||
| while (status != STATUS_FATAL_APP_EXIT) | ||
| #if !defined(_POWERKATZ) | ||
| while ((status != STATUS_PROCESS_IS_TERMINATING) && (status != STATUS_THREAD_IS_TERMINATING)) | ||
| { | ||
| kprintf(L"\n" MIMIKATZ L" # "); fflush(stdin); | ||
| if(fgetws(input, ARRAYSIZE(input), stdin) && (len = wcslen(input)) && (input[0] != L'\n')) | ||
|
|
@@ -56,12 +45,39 @@ int wmain(int argc, wchar_t * argv[]) | |
| } | ||
| } | ||
| #endif | ||
| mimikatz_end(status); | ||
| return STATUS_SUCCESS; | ||
| } | ||
|
|
||
| void mimikatz_begin() | ||
| { | ||
| kull_m_output_init(); | ||
| #if !defined(_POWERKATZ) | ||
| SetConsoleTitle(MIMIKATZ L" " MIMIKATZ_VERSION L" " MIMIKATZ_ARCH L" (oe.eo)"); | ||
| SetConsoleCtrlHandler(HandlerRoutine, TRUE); | ||
| #endif | ||
| kprintf(L"\n" | ||
| L" ___ _ " MIMIKATZ_FULL L"\n" | ||
| L" / ('>- " MIMIKATZ_SECOND L"\n" | ||
| L" | K | /* * *\n" | ||
| L" \\____/ Benjamin DELPY `gentilkiwi` ( [email protected] )\n" | ||
| L" L\\_ https://blog.gentilkiwi.com/kekeo (oe.eo)\n" | ||
| L" " MIMIKATZ_SPECIAL L" with %2u modules * * */\n", ARRAYSIZE(mimikatz_modules)); | ||
| mimikatz_initOrClean(TRUE); | ||
| } | ||
|
|
||
| void mimikatz_end(NTSTATUS status) | ||
| { | ||
| mimikatz_initOrClean(FALSE); | ||
| #ifndef _WINDLL | ||
| #if !defined(_POWERKATZ) | ||
| SetConsoleCtrlHandler(HandlerRoutine, FALSE); | ||
| #endif | ||
| kull_m_output_clean(); | ||
| #if !defined(_WINDLL) | ||
| if(status == STATUS_THREAD_IS_TERMINATING) | ||
| ExitThread(STATUS_SUCCESS); | ||
| else ExitProcess(STATUS_SUCCESS); | ||
| #endif | ||
| return STATUS_SUCCESS; | ||
| } | ||
|
|
||
| BOOL WINAPI HandlerRoutine(DWORD dwCtrlType) | ||
|
|
@@ -200,7 +216,7 @@ NTSTATUS mimikatz_doLocal(wchar_t * input) | |
| return status; | ||
| } | ||
|
|
||
| #ifdef _WINDLL | ||
| #if defined(_POWERKATZ) | ||
| __declspec(dllexport) wchar_t * powershell_reflective_kekeo(LPCWSTR input) | ||
| { | ||
| int argc = 0; | ||
|
|
@@ -216,4 +232,29 @@ __declspec(dllexport) wchar_t * powershell_reflective_kekeo(LPCWSTR input) | |
| } | ||
| return outputBuffer; | ||
| } | ||
| #endif | ||
|
|
||
| #if defined(_WINDLL) | ||
| void CALLBACK kekeo_dll(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow) | ||
| { | ||
| int argc = 0; | ||
| wchar_t ** argv; | ||
|
|
||
| AllocConsole(); | ||
| #pragma warning(push) | ||
| #pragma warning(disable:4996) | ||
| freopen("CONOUT$", "w", stdout); | ||
| freopen("CONOUT$", "w", stderr); | ||
| freopen("CONIN$", "r", stdin); | ||
| #pragma warning(pop) | ||
| if(lpszCmdLine && lstrlenW(lpszCmdLine)) | ||
| { | ||
| if(argv = CommandLineToArgvW(lpszCmdLine, &argc)) | ||
| { | ||
| wmain(argc, argv); | ||
| LocalFree(argv); | ||
| } | ||
| } | ||
| else wmain(0, NULL); | ||
| } | ||
| #endif | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,45 @@ | ||
| /* Benjamin DELPY `gentilkiwi` | ||
| http://blog.gentilkiwi.com | ||
| [email protected] | ||
| Licence : https://creativecommons.org/licenses/by/4.0/ | ||
| */ | ||
| #pragma once | ||
|
|
||
| #include "globals.h" | ||
| #include "modules/kuhl_m_standard.h" | ||
| #include "modules/kuhl_m_tgt.h" | ||
| #include "modules/kuhl_m_tgs.h" | ||
| #include "modules/kuhl_m_exploit.h" | ||
| #include "modules/kuhl_m_misc.h" | ||
| #include "modules/kerberos/kuhl_m_kerberos.h" | ||
| #include "modules/kuhl_m_smb.h" | ||
| #include "modules/kuhl_m_ntlm.h" | ||
| #include "modules/kuhl_m_tsssp.h" | ||
| #include "modules/kuhl_m_server.h" | ||
|
|
||
| #include "../modules/kull_m_file.h" | ||
| #include "../modules/asn1/kull_m_kerberos_asn1.h" | ||
|
|
||
| extern VOID WINAPI RtlGetNtVersionNumbers(LPDWORD pMajor, LPDWORD pMinor, LPDWORD pBuild); | ||
|
|
||
| int wmain(int argc, wchar_t * argv[]); | ||
|
|
||
| BOOL WINAPI HandlerRoutine(DWORD dwCtrlType); | ||
|
|
||
| NTSTATUS mimikatz_initOrClean(BOOL Init); | ||
|
|
||
| NTSTATUS mimikatz_doLocal(wchar_t * input); | ||
| NTSTATUS mimikatz_dispatchCommand(wchar_t * input); | ||
| /* Benjamin DELPY `gentilkiwi` | ||
| https://blog.gentilkiwi.com | ||
| [email protected] | ||
| Licence : https://creativecommons.org/licenses/by/4.0/ | ||
| */ | ||
| #pragma once | ||
|
|
||
| #include "globals.h" | ||
| #include "modules/kuhl_m_standard.h" | ||
| #include "modules/kuhl_m_tgt.h" | ||
| #include "modules/kuhl_m_tgs.h" | ||
| #include "modules/kuhl_m_exploit.h" | ||
| #include "modules/kuhl_m_misc.h" | ||
| #include "modules/kerberos/kuhl_m_kerberos.h" | ||
| #include "modules/kuhl_m_smb.h" | ||
| #include "modules/kuhl_m_ntlm.h" | ||
| #include "modules/kuhl_m_tsssp.h" | ||
| #include "modules/kuhl_m_server.h" | ||
|
|
||
| #include "../modules/kull_m_file.h" | ||
| #include "../modules/asn1/kull_m_kerberos_asn1.h" | ||
|
|
||
| extern VOID WINAPI RtlGetNtVersionNumbers(LPDWORD pMajor, LPDWORD pMinor, LPDWORD pBuild); | ||
|
|
||
| int wmain(int argc, wchar_t * argv[]); | ||
| void mimikatz_begin(); | ||
| void mimikatz_end(NTSTATUS status); | ||
|
|
||
| BOOL WINAPI HandlerRoutine(DWORD dwCtrlType); | ||
|
|
||
| NTSTATUS mimikatz_initOrClean(BOOL Init); | ||
|
|
||
| NTSTATUS mimikatz_doLocal(wchar_t * input); | ||
| NTSTATUS mimikatz_dispatchCommand(wchar_t * input); | ||
|
|
||
| #if defined(_POWERKATZ) | ||
| __declspec(dllexport) wchar_t * powershell_reflective_kekeo(LPCWSTR input); | ||
| #elif defined(_WINDLL) | ||
| void CALLBACK kekeo_dll(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow); | ||
| #if defined(_M_X64) || defined(_M_ARM64) | ||
| #pragma comment(linker, "/export:mainW=kekeo_dll") | ||
| #elif defined(_M_IX86) | ||
| #pragma comment(linker, "/export:mainW=_kekeo_dll@16") | ||
| #endif | ||
| #endif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.