Who is Benjamin Delpy?

Table of Contents

Benjamin Delpy, is a Security Researcher known as `gentilkiwi`. A Security enthusiast, he publishes tools and articles that speak about products’ weaknesses and prove some of his ideas. Mimikatz was the first software he developed that reached an international audience.

Is Mimikatz safe?

In 2011, security researcher Benjamin Delpy discovered with Windows WDigest vulnerability. This security hole allows attackers to access internal storage on a Windows system, which holds user account passwords, and also obtain the keys to decrypt them.

Does Mimikatz work on Windows 10?

Does MimiKatz Still Work on Windows 10? Yes, it does. Attempts by Microsoft to inhibit the usefulness of the tool have been temporary and unsuccessful. The tool has been continually developed and updated to enable its features to plow right through any OS-based band-aid.

Who created Mimikatz?

Benjamin Delpy
The software was created by Benjamin Delpy in 2007 as a PoC with the purpose of learning how Microsoft’s authentication protocols were vulnerable to attacks. However, in time, Mimikatz turned into one of the most powerful password stealers.

Does Mimikatz run in memory?

To detect Mimikatz activity, I went to the core of what Mimikatz needs to run, namely its loading of Windows DLLs. This is important as this will always occur no matter what process Mimikatz is injected into and cannot be obfuscated via in-memory execution or a packed exe.

Why is it called Mimikatz?

The name “mimikatz” comes from the French slang “mimi” meaning cute, thus “cute cats.” (Delpy is French and he blogs on Mimikatz in his native language.)

What can you do with Mimikatz?

The main functions that Mimikatz enables include:

Extracting passwords from memory.
Extracting Kerberos tickets.
Extracting certificates and their private keys.

Does McAfee use Mimikatz?

Regarding the use on Mimikatz in the example above, the new McAfee ENS 10.7 ATP Credential Theft Protection is designed to cease attacks against Windows LSASS so that you do not need to rely on the detection of Mimikatz. ENS 10.7 ATP is now included in most McAfee Endpoint Security licenses at no additional cost.

Where can I buy Mimikatz?

The best place to get Mimikatz is from the Mimikatz GitHub project page, where you can download the Mimikatz source code. Precompiled binaries for Windows are also available from the Mimikatz GitHub page. If you choose to download the Mimikatz source code, you’ll need to compile the code with Microsoft Visual Studio.

Does Mimikatz use PowerShell?

PowerShell & Mimikatz: The majority of Mimikatz functionality is available in PowerSploit (PowerShell Post-Exploitation Framework) through the “Invoke-Mimikatz” PowerShell script (written by Joseph Bialek) which “leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory.