Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate Mimikatz credentials collector to a plugin #3168

Closed
14 tasks done
mssalvatore opened this issue Mar 28, 2023 · 0 comments
Closed
14 tasks done

Migrate Mimikatz credentials collector to a plugin #3168

mssalvatore opened this issue Mar 28, 2023 · 0 comments

Comments

@mssalvatore
Copy link
Collaborator

mssalvatore commented Mar 28, 2023

Description

Migrate the Mimikatz credentials collector to a plugin.#3167

Tasks

  • Define config-schema.json, manifest, and options (0d) @ilija-lazoroski @ordabach
  • Create pipfile for dependencies (0d) @ilija-lazoroski @ordabach
  • Add A jenkins job to build the plugin (0d) @ilija-lazoroski @ordabach
    • Update the island build jobs on Jenkins to copy the artifacts from the Mimikatz plugin build job
  • Add a build script for building plugins on Windows. Modify the mimikatz jenkins job as necessary. (0d) @ilija-lazoroski, @shreyamalviya
  • Convert the existing mimikatz collector to a plugin (0d) @mssalvatore
    • Update ETE test configuration
    • Reimplement unit tests
  • Remove the hard-coded mimikatz credentials collector plugin (0d) @mssalvatore
  • Fix wmi_mimikatz and depth_1 smb mimikatz tests (see below) (0d) - @shreyamalviya
    • Remove wmi_mimikatz test
    • Modify depth_1_a to call the stolen credentials endpoint and assert that expected credentials were stolen
  • Remove vulture entries
  • Fix logging (leaking credentials) (0d) @ilija-lazoroski

Broken tests

image

This test is supposed to test that credentials are collected from mimikatz 14 and used to access mimikatz 15. It should be a depth 2 test and shouldn't include valid credentials for mimikatz 15 in the configuration.

Also check the depth_1_a test, as this has comments about mimikatz password stealing. I'm not sure how this can be properly tested with a depth 1 test.

@mssalvatore mssalvatore added this to the v2.2.0 milestone Mar 28, 2023
shreyamalviya added a commit that referenced this issue Apr 28, 2023
This test wasn't actually testing the Mimikatz credential
collector due to a misconfiguration on the mimikatz-15 machine.
We decided this test isn't worth keeping since the WMI exploiter
is already tested in depth_3_a and depth_4_a, and Mimikatz is
tested in depth_1_a (with SMB).

Issue #3168
PR #3274
mssalvatore pushed a commit that referenced this issue Apr 28, 2023
This test wasn't actually testing the Mimikatz credential
collector due to a misconfiguration on the mimikatz-15 machine.
We decided this test isn't worth keeping since the WMI exploiter
is already tested in depth_3_a and depth_4_a, and Mimikatz is
tested in depth_1_a (with SMB).

Issue #3168
PR #3274
ordabach added a commit that referenced this issue May 3, 2023
ilija-lazoroski added a commit that referenced this issue May 3, 2023
ilija-lazoroski added a commit that referenced this issue May 3, 2023
@mssalvatore mssalvatore mentioned this issue May 3, 2023
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant