rekall.plugins.windows.mimikatz

Module mimikatz

Partial emulation of the Mimikatz tool.

This code replicates the algorithm first implemented in the mimikatz tool, which can be found here:

https://github.com/gentilkiwi/mimikatz

Author: Michael Cohen <scudette@google.com> and Francesco Picasso <francesco.picasso@gmail.com>

Classes

Lsasrv
A profile for lsasrv.dll

Wdigest
A profile for wdigest.dll

Livessp
A profile for livessp.dll

Mimikatz
Extract and decrypt passwords from the LSA Security Service.

Variables

mimikatz_common_overlays = {'_LSA_STRING': [None, {'Raw': <fun...

__package__ = 'rekall.plugins.windows'

Variables Details

mimikatz_common_overlays

Value:

{'_LSA_UNICODE_STRING': [None, {'Value': lambda x: x.Buffer.dereferenc
e_as('UnicodeString', target_args= dict(length= x.Length)), 'Raw': lam
bda x: x.Buffer.dereference_as('String', target_args= dict(length= x.L
ength, term= None)).v(), 'RawMax': lambda x: x.Buffer.dereference_as('
String', target_args= dict(length= x.MaximumLength, term= None)).v(),}
], '_LSA_STRING': [None, {'Value': lambda x: x.Buffer.dereference_as('
String', target_args= dict(length= x.Length)), 'Raw': lambda x: x.Buff
er.dereference_as('String', target_args= dict(length= x.Length, term= 
...