Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/ufrisk/MemProcFS-plugins
https://github.com/ufrisk/MemProcFS-plugins
Last synced: about 1 month ago
JSON representation
- Host: GitHub
- URL: https://github.com/ufrisk/MemProcFS-plugins
- Owner: ufrisk
- License: gpl-3.0
- Created: 2019-03-17T20:30:59.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2024-10-12T19:18:21.000Z (2 months ago)
- Last Synced: 2024-10-29T16:17:14.277Z (about 1 month ago)
- Language: Python
- Size: 862 KB
- Stars: 55
- Watchers: 7
- Forks: 10
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-qubes-os - MemProcFS-Plugins - This repository contains various non-core plugins for MemProcFS - The Memory Process File System. (Exploitation Tools / Unikernel-like)
README
Plugins for MemProcFS
===============================
This repository contains various non-core plugins for [MemProcFS - The Memory Process File System](https://github.com/ufrisk/MemProcFS).Plugins range from non-core plugins to plugins that have offensive capabilities - such as _pypykatz_. Please find a short description for each plugin below:
## pypykatz regsecrets
#### Author:
Tamas Jos ([@skelsec](https://twitter.com/SkelSec)) , [email protected] , https://github.com/skelsec/#### Overview:
_regsecrets_ for MemProcFS exposes mimikatz functionality in the folder `/py/regsecrets/` in the file system root provided that the target is a supported Windows system. Functionality includes retrieval NTLM hashes for local accounts amongst other things.#### Installation instructions:
1) Ensure MemProcFS supported version of 64-bit Python for Windows is on the system path (or specify in `-pythonpath` option when starting MemProcFS). NB! embedded Python will not work with _pypykatz_ and _aiowinreg_ since it requires access to Python pip installed packages.
2) Install _pypykatz_ and _aiowinreg_ pip package, in correct python environment, by running `pip install pypykatz aiowinreg`.
3) Copy the _pyregsecrets_ for _MemProcFS_ plugin by copying all files from [`/files/plugins/pym_regsecrets`](https://github.com/ufrisk/MemProcFS-plugins/tree/master/files/plugins/pym_regsecrets) to corresponding folder in MemProcFS - overwriting any existing files there.
4) Start MemProcFS.#### Last updated: 2021-03-21