mimikittenz – A post-exploitation powershell tool for extracting juicy info from memory

mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.

mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns including but not limited to:

  • TRACK2 (CreditCard) data from merchant/POS processes
  • PII data
  • Encryption Keys & All the other goodstuff

note: This tool is targeting running process memory address space, once a process is killed it’s memory ‘should’ be cleaned up and inaccessible however there are some edge cases in which this does not happen.

Screenshot(s)

Description

The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target.

Currently mimikittenz is able to extract the following credentials from memory:

Webmail
  • Gmail
  • Office365
  • Outlook Web
Accounting
  • Xero
  • MYOB
Remote Access
  • Juniper SSL-VPN
  • Citrix NetScaler
  • Remote Desktop Web Access 2012
Developement
  • Jira
  • Github
  • Bugzilla
  • Zendesk
  • Cpanel
IHateReverseEngineers
  • Malwr
  • VirusTotal
  • AnubisLabs
Misc
  • Dropbox
  • Microsoft Onedrive
  • AWS Web Services
  • Slack
  • Twitter
  • Facebook

 

DOWNLOAD: https://github.com/putterpanda/mimikittenz

Anúncios
Sem categoria

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s