MimiRust - Hacking the Windows operating system to hand us the keys to the kingdom with Rust

Last update: Dec 29, 2022

Related tags

Overview

MimiRust - Hacking the Windows operating system to hand us the keys to the kingdom with Rust.



███▄ ▄███▓ ██▓ ███▄ ▄███▓ ██▓ ██▀███   █    ██   ██████ ▄▄▄█████▓
▓██▒▀█▀ ██▒▓██▒▓██▒▀█▀ ██▒▓██▒▓██ ▒ ██▒ ██  ▓██▒▒██    ▒ ▓  ██▒ ▓▒
▓██    ▓██░▒██▒▓██    ▓██░▒██▒▓██ ░▄█ ▒▓██  ▒██░░ ▓██▄   ▒ ▓██░ ▒░
▒██    ▒██ ░██░▒██    ▒██ ░██░▒██▀▀█▄  ▓▓█  ░██░  ▒   ██▒░ ▓██▓ ░
▒██▒   ░██▒░██░▒██▒   ░██▒░██░░██▓ ▒██▒▒▒█████▓ ▒██████▒▒  ▒██▒ ░
░ ▒░   ░  ░░▓  ░ ▒░   ░  ░░▓  ░ ▒▓ ░▒▓░░▒▓▒ ▒ ▒ ▒ ▒▓▒ ▒ ░  ▒ ░░
░  ░      ░ ▒ ░░  ░      ░ ▒ ░  ░▒ ░ ▒░░░▒░ ░ ░ ░ ░▒  ░ ░    ░
░      ░    ▒ ░░      ░    ▒ ░  ░░   ░  ░░░ ░ ░ ░  ░  ░    ░
       ░    ░         ░    ░     ░        ░           ░

                written in Rust by ThottySploity
        mimiRust $ means it's running without elevated privileges
         mimiRust # means it's running with elevated privileges
          mimiRust @ means it's running with system privileges


mimiRust @ ?

Choose one of the following options:

  passwords:
          • dump-credentials             Dumps systems credentials through Wdigest.
          • dump-hashes                  Dumps systems NTLM hashes (requires SYSTEM permissions).
          • clear                        Clears the screen of any past output.
          • exit                         Moves to top level menu

  pivioting:
          • shell         Execute a shell command through cmd, returns output.
          • clear                        Clears the screen of any past output.
          • exit                         Moves to top level menu
          • (W.I.P)psexec                Executes a service on another system.
          • (W.I.P)pth                   Pass-the-Hash to run a command on another system.
          • (W.I.P)golden-ticket         Creates a golden ticket for a user account with the domain.

  privilege:
          • spawn-path       Spawn program with SYSTEM permissions from location.
          • clear                        Clears the screen of any past output.
          • exit                         Moves to top level menu

mimiRust @ passwords
mimiRust::passwords @ dump-credentials

MimiRust is a post-exploitation tool that can be used within redteam operations. Like the name suggests the entire project is made within the Rust language. MimiRust is capable of the following actions:

Spawning any process as SYSTEM
Executing shell commands
Extracting Windows passwords out of memory through the wdigest attack vector.
Extracting Windows NTLM hashes from user accounts (aes / des) & (md5 / rc4)

Todo:

PSExec to create service on another endpoint.
PtH (Pass-The-Hash)
Kerberos Golden Ticket

Maybe in the future I will make it polymorphic and obfuscate the strings (also polymorphic) and API calls.

Quick usage:

MimiRust can be ran in two different ways: from the command line using mimiRust.exe --help or in the shell by running the executable without any command line arguments. For help with the program type one of the following into mimiRust:

mimiRust # ?
mimiRust # h
mimiRust # help

You will now be required to type in the module that you want to access, current modules are:

passwords
pivioting
privilege

Dumping credentials from memory through wdigest

mimiRust::passwords # dump-credentials
mimiRust.exe --dump-credentials

Dumping NTLM hashes from user accounts

mimiRust::passwords @ dump-hashes
mimiRust.exe --dump-hashes

Executing shell commands

mimiRust::pivioting $ shell whoami

Spawning a process with SYSTEM

mimiRust::privilege # spawn-path cmd.exe
mimiRust.exe -s cmd.exe

Demo

click on the demo to get a higher resolution

Disclaimer

I am not responsible for what you do with the information and code provided. This is intended for professional or educational purposes only.

Author

Why was MimiRust made

MimiRust was created as a project by a first years Cyber Security Bachelors student. The reason for this is because I was too bored learning about business processes in a Security Bachelors that I decided to just start for myself.

A tool to identify related SSL keys, CSRs, and certificates.

⛓ sslchains A tool to identify related SSL keys, CSRs, and certificates. Usage Default Display Mode Run with any number of path arguments to define th

1 Apr 2, 2022

Project Masterpass is a deterministic databaseless key management algorithm, aimed to help those who cannot protect their encryption keys in storage

Project Masterpass (working title) Attention! This project is still under heavy development, and SHOULD NOT be used in practice, as the algorithms cou