Mimikatz


Mimikatz is both an exploit on Microsoft Windows that extracts passwords stored in memory and software that performs that exploit. It was created by French programmer Benjamin Delpy and is French slang for "cute cats".

History

Benjamin Delpy discovered a flaw in Microsoft Windows that holds both an encrypted copy of a password and a key that can be used to decipher it in memory at the same time. He contacted Microsoft in 2011 to point out the flaw, but Microsoft replied that it would require the machine to be already compromised. Delpy realised that the flaw could be used to gain access to non-compromised machines on a network from a compromised machine.
He released the first version of the software in May 2011 as closed source software.
In September 2011, the exploit was used in the DigiNotar hack.

Russian conference

Delpy spoke about the software at a conference in 2012. Once during the conference, he returned to his room to find a stranger sitting at his laptop. The stranger apologised, saying he was in the wrong room and left. A second man approached him during the conference and demanded he give him copies of his presentation and software on a USB flash drive. Delpy gave him copies.
Delpy felt shaken by his experiences and before he left Russia, he released the source code on GitHub. He felt that those defending against cyberattacks should learn from the code in order to defend against the attack.

Windows updates

In 2013 Microsoft added a feature to Windows 8.1 that would allow turning off the feature that could be exploited. In Windows 10 the feature is turned off by default, but Jake Williams from Rendition Infosec says that it remains effective, either because the system runs an outdated version of Windows, or he can use privilege escalation to gain enough control over the target to turn on the exploitable feature.

Use in malware

The Carbanak attack and the cyberattack on the Bundestag used the exploit. The NotPetya and BadRabbit malware used versions of the attack combined with EternalBlue and EternalRomance exploits.

In popular culture

In Mr. Robot episode 9 of season 2, Angela Moss uses mimikatz to get her boss's Windows domain password.