So here's another great example of how Métis Point framework expands.
When new tools arrive, they are rapidly integrated into the framework.
Mimi Katz is one of them which is integrated into MSF, like the.
It was first written by Benjamin Delpy as opposed to exploitation tool.
Basically, it attempts to get users clear text passwords from the memory over the interpreter session.
Now, I know that you've already used the hashes by using the pass the hash tag.
However, sometimes passwords can also be required to save time from the beginning.
So that's when you can use the Mimecast extension to get clear text passwords from the memory of the
compromised target, leaving no trace on the disk.
And there's one more thing to keep in mind.
Mimecast version one is implemented in MSF, but later on when Mimecast version two was released.
It got implemented into the MSF and named Kiwi.
So I'm going to start with Lowed Mimecast first.
But for sure, you've got to have system privileges.
And to extensions type lowed, el.
And these are the available extensions to load on this session.
Loading is a very easy process, just type load, and then the name of the extension in this case,
Jimmy Cat.
Now, it gives a warning about using Kiwi, but you can disregard it.
So after you load Mimi Katz type help.
Mimi Katz to list.
The commands of the extension.
And with the memory cards come in.
You can directly run Meimi Katz command by themselves.
Now, I know this is a weird sentence, but it really will help you to execute all Mimecast modules
directly.
But the other commands are like short cuts of some memy cats' module's.
You'll you'll get what I mean in a couple of seconds.
So type Kerberos.
To get the clear text Kouros credentials.
And look at the password column.
See how you get that clear text password.
Now, it doesn't matter how strong the password is.
And you can also list live SSP credentials by typing live SSP.
If, of course, live SSP is applicable for the current operating system.
But this time you see password hashes in the password column.
So it's also possible to get SSP credentials if they're available.
So type this package to view the package credentials.
Now you can see clear text passwords on the last column.
Now, time to digest.
To get clear passwords from the Web Digest package.
So if you're wondering what are all these toys packaged, digest and all these others, they are all
Microsoft security packages.
So the implementations of these packages differ from OS to OS.
And if you really want to know about these implementations, you can search for them on the World Wide
Web, that thing that binds us all.
But believe me, there's a lot to read, there's a very large topic.
So for now, let's only get the passwords and clear text.
OK, then the Mimecast can't command.
This command enables you to run Mimecast commands on the target directly.
So first type help.
Mimi Katz, command groups hope you didn't see that.
Then type Mimi Katz, command H to get the help menu.
So maybe Cats' has modules and each module has different functions and each function has its own parameters.
So in order to list the module's type, Maemi cance command f f u.
And here, the Mimecast module's.
We can't command F Krypto.
We'll list the functions of the crypto module.
Whisky's.
Well, I'll give you a list of crypto keys in the memory.
Now will assume that you are in a server that has an SSL certificate.
This will really help you to extract Keith.
List providers.
Well, bring the crypto providers like you see right here.
SEC.
Earl as a.
That's another useful module.
And if you read through this, these are the functions of this module.
So the names are similar to the interpreter commands of this extension.
So MTV will bring only the password hashes.
Digest will generally bring the clear tax password's due to its implementation.
And at the end of the line, there are the password's.
Tuberose is also an important function because it brings the Password's and Kouros ticket if it's applicable
for the current operating system.
Then tax package.
Is also very useful, it brings the credentials.
So if live SSP and ASSP are available.
You can also get credentials of these packages by simply typing live ASSP and.
Espe.
So in my case here, there are no credentials provided by these packages.
Now, it's also possible to get logged in users passwords from memory, so let's pass the log on passwords.
To Mimi Katz command.
Now, you see, here are the password hashes for each user.
Sometimes it brings up like this.
It might change due to the operating system.
And then the last SEC earl as a function is search password's.
So that's going to bring up all the clear text passwords from all the modules.
Now, here, you might be seeing the same username a few times because Mimi Katz extracts each username
password from different security packages, DRL files.
Now, the second extension is actually an upgraded version of Mimecast.
That's called Kiwi.
So load Kiwi.
And now you're able to run the Kiwi command.
And in order to see the available Kiwi commands type help Kiwi.
And then the logic is exactly the same as Mimecast.
You can list Kerberos credentials by typing Creg, Kerberos.
But this time, I think the view is better.
So type in KRED M.
S V to get M as V credentials.
Albert Krejza mSv sometimes can cause crashes on the target, it just randomly happens, but, you know,
just be prepared.
And what do you know, as if I predict the future.
So because it's happened, I'm not going to panic, I will use my RC file.
To bring up a session again.
Now, it takes a while to get a session again.
But finally, I've got my new session.
OK, then use creds ASSP for ASSP credentials.
Credits package.
That's going to get me passwords from this DL.
But there's nothing really meaningful.
OK, creds digest.
And the situation is the same.
So at the end, you extract some clear text passwords from the memory of the target.
And now you can use these credentials to further compromise your target.