https://github.com/ufrisk/MemProcFS-plugins

https://github.com/ufrisk/MemProcFS-plugins

Last synced: 6 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/ufrisk/MemProcFS-plugins
• Owner: ufrisk
• License: gpl-3.0
• Created: 2019-03-17T20:30:59.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2024-10-12T19:18:21.000Z (about 1 month ago)
• Last Synced: 2024-10-29T16:17:14.277Z (14 days ago)
• Language: Python
• Size: 862 KB
• Stars: 55
• Watchers: 7
• Forks: 10
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-qubes-os - MemProcFS-Plugins - This repository contains various non-core plugins for MemProcFS - The Memory Process File System. (Exploitation Tools / Unikernel-like)

README

        
Plugins for MemProcFS

===============================

This repository contains various non-core plugins for [MemProcFS - The Memory Process File System](https://github.com/ufrisk/MemProcFS).

Plugins range from non-core plugins to plugins that have offensive capabilities - such as _pypykatz_. Please find a short description for each plugin below:

## pypykatz regsecrets

#### Author:

Tamas Jos ([@skelsec](https://twitter.com/SkelSec)) , [email protected] , https://github.com/skelsec/

#### Overview:

_regsecrets_ for MemProcFS exposes mimikatz functionality in the folder `/py/regsecrets/` in the file system root provided that the target is a supported Windows system. Functionality includes retrieval NTLM hashes for local accounts amongst other things.



#### Installation instructions:

1) Ensure MemProcFS supported version of 64-bit Python for Windows is on the system path (or specify in `-pythonpath` option when starting MemProcFS). NB! embedded Python will not work with _pypykatz_ and _aiowinreg_ since it requires access to Python pip installed packages.

2) Install _pypykatz_ and _aiowinreg_ pip package, in correct python environment, by running `pip install pypykatz aiowinreg`.

3) Copy the _pyregsecrets_ for _MemProcFS_ plugin by copying all files from [`/files/plugins/pym_regsecrets`](https://github.com/ufrisk/MemProcFS-plugins/tree/master/files/plugins/pym_regsecrets) to corresponding folder in MemProcFS - overwriting any existing files there.

4) Start MemProcFS.

#### Last updated: 2021-03-21