Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.











  






! 
(U)!Mimikatz!was!analyzed!in3depth!in!an!attempt!to!isolate!the!techniques!and!subroutines!
used!in!harvesting!usernames!and!passwords.!After!thorough!static!and!dynamic!analysis,!the!
task!in!question!was!determined!to!exceed!the!scope!of!a!traditional!program3based!PoC.!!
! 
(U)!The!following!sections!detail!various!highlights!found!during!research!and!analysis.!
! 
!! kuhl_m_lsadump.c!
!! kuhl_m_sekurlsa.c!–!Place!initial!breakpoint!in!kuhl_m_sekurlsa_enum()!
!! kuhl_m_sekurlsa_nt6.c!
!! kuhl_m_sekurlsa_utils.c!
!! mimikatz.c!
! 
!! Frequently,!switch()!statements!were!used!in!the!place!of!if()!statements.!
!! Almost!all!parameters!are!structures.!The!structures!typically!contain!multiple!other!
user3defined!structures!as!well!as!functions.!For!example,!
kuhl_m_sekurlsa!kuhl_m_sekurlsa_acquireLSA()!calls!initLocalLib()!which!is!a!function!
within!the!lsassLocalHelper!instance!of!the!global!structure!
KUHL_M_SEKURLSA_LOCAL_HELPER.!
!! The!limited!documentation!available!online!is!also!incomplete.!For!example,!the!code!
path!exists!to!parse!an!LSASS!minidump;!however,!the!functionality!and!appropriate!
command!syntax!is!not!documented.!
!! Kuhl_m_sekurlsa!kuhl_m_sekurlsa_acquireLSA()!contains!most!of!the!critical!
functionality.!
!! Kull_m_memory!kull_m_memory_search()!appears!to!be!the!function!that!finally!
performs!the!search;!however,!it!appears!to!be!a!recursive!call.!Complicating!matters!
further,!the!PKULL_M_MEMORY_SEARCH!structure!nests!an!addition!6!structures.!None!
of!the field!names!or!their!associated!values!indicate!a!specific!pattern!to!search!for.!
!! The!author!removed!the!DEBUG!build!configuration.!When!configuring!a!DEBUG!
configuration!manually,!ensure!that!all!the!linker!generates!debugging!information!and!
all!optimizations!are!disabled.!
!! The!AcquireKeys()!call!suggests!there!are!additional!decryption!/!deobfuscation!
measures.!

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh