One Day Sec

What is mimilib.dll and how is it used for credential theft via the Security Support Provider (SSP) feature?

Mimilib.dll is a subproject of mimikatz that, when loaded into lsass.exe, can capture plaintext passwords. The SSP feature uses the `SpLsaModeInitialize` export function. To deploy it, save the DLL to `%SystemRoot%\System32`, add `mimilib` to the `Security Packages` registry value under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa`, and restart the system. This causes lsass.exe to load the DLL and write captured passwords to `kiwissp.log`.
mimilibmimikatzSSPcredential theftSecurity Support Providerlsasspassword captureregistry

Browse all Q&A →