orlyjamie / mimikittenz

A post-exploitation powershell tool for extracting juicy info from memory.
1.82k stars 334 forks source link

Truncated results #5

Closed theabraxas closed 8 years ago

theabraxas commented 8 years ago

Results all look like this:

PatternName PatternMatch


CitrixNetScaler login=.{1,22}&passwd=.{1,42}"xml D A ?J  ...

The ellipses at the end for each line in the result, It happens both when I run it in terminal and > to output file. I assume there's some line/width buffer that can be increased? Would definitely be worth adding to the docs.

kamakazikamikaze commented 8 years ago

Same issue here, happens to all output

leesoh commented 8 years ago

Same here.

Pips801 commented 8 years ago

powershell_2016-07-07_16-41-26

Same here.

Lemmmy commented 8 years ago

See #4

orlyjamie commented 8 years ago

[Non-issue] - Victim user would never be browsing this github, if they are you already failed :laughing:

ionrover2 commented 8 years ago

So was there any particular reason this was closed non issue?

orlyjamie commented 8 years ago

Hello ionrover2, please checkout https://github.com/putterpanda/mimikittenz/issues/4 - For sake of explanation - The reason users are seeing this strange output is because they've viewed the powershell code from the same browser that they are dumping process memory from.

In-case that's not self explanatory, the powershell code does not actually know what is a password and what is not, all it is doing is going through the memory space utilizing regular expressions - So it's actually doing it's job by picking these out.

It was labelled as a [Non-issue] due to the fact that in a real-world scenario, these strings are not going to already exist within a victims browser process memory (Unless the victim user has been looking at this code in their browser before-hand) .. If the victim is looking at this code in their browser before you run the script - You've got bigger things to worry about :laughing:

ionrover2 commented 8 years ago

That makes perfect sense. My bad.

orlyjamie commented 8 years ago

All good mate, thanks for double checking :+1: