dangtrinhnt

#! /bin/env python
# 
# USAGE
# $ python ad_utils.py "My Group Name"
#
# Author: 
# Trinh Nguyen
# dangtrinhnt@gmail.com
# www.dangtrinh.com

maxvt

Currently, there is an explosion of tools that aim to manage secrets for automated, cloud native infrastructure management. Daniel Somerfield did some work classifying the various approaches, but (as far as I know) no one has made a recent effort to summarize the various tools.

This is an attempt to give a quick overview of what can be found out there. The list is alphabetical. There will be tools that are missing, and some of the facts might be wrong--I welcome your corrections. For the purpose, I can be reached via @maxvt on Twitter, or just leave me a comment here.

There is a companion feature matrix of various tools. Comments are welcome in the same manner.

Raikia

Assuming you have a mimikatz dump named "mimikatz_dump.txt", I made these bash one-liners that will reformat the mimikatz output to "domain\user:password"

First, before using these parsers, run:  "dos2unix mimikatz_dump.txt"

Mimikatz 1.0:

cat mimikatz_dump.txt  | grep -P '((Utilisateur principal)|(msv1_0)|(kerberos)|(ssp)|(wdigest)|(tspkg))\s+:\s+.+' | grep -v 'n\.' | sed -e 's/^\s\+[^:]*:\s\+//' | sed -e 's/Utilisateur principal\s\+:\s\+\(.*\)$/\n\1/' | sort -u


Mimikatz 2.0 (unfortunately, you must "apt-get install pcregrep" because reasons):

Ayrx

#!/usr/bin/env python
from __future__ import print_function
import sys
import os
import re
import ctypes
import argparse

ulseek = ctypes.cdll['libc.so.6'].lseek
ulseek.restype = ctypes.c_uint64

cdhunt

<#
.SYNOPSIS
Gets a PowerShell Credential (PSCredential) from the Windows Credential Manager

.DESCRIPTION
This module will return a [PSCredential] object from a credential stored in Windows Credential Manager. The 
Get-StoredCredential function can only access Generic Credentials.

Alias: GSC

toburger

<#
    .SYNOPSIS
    Gets a PowerShell Credential (PSCredential) from the Windows Credential Manager

    .DESCRIPTION
    Adapted from: http://stackoverflow.com/questions/7162604/get-cached-credentials-in-powershell-from-windows-7-credential-manager

    .PARAMETER TargetName
    The name of the target login informations in the Windows Credential Manager

velaskec

#############################################################################################################
# PowerSlim 0.1
#############################################################################################################
import os,re
import clr,os	
clr.AddReference("System.Management")
clr.AddReference("System.Management.Automation")
from System.Management.Automation import *
from System.Management.Automation.Host import *
from System.Management.Automation.Runspaces import *