Skip to content

Commit 77af70f

Browse files
0x6d69636b0x6d69636b
committed
Search for Domain and Local Accounts
[*] Replaced Select-MimikatzPasswords.ps1 with Select-MimikatzDomainAccounts.ps1 and Select-MimikatzLocalAccounts.ps1 [*] Update for Invoke-MimikatzNetwork.ps1 and PowerShellUtilities.psd1
1 parent b89cf8c commit 77af70f

5 files changed

+257
-105
lines changed

‎Invoke-MimikatzNetwork.ps1

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
Optional Dependencies: None
99
#>
1010

11-
#Requires -Version 2
12-
Set-StrictMode -Version 2
11+
#Requires -Version 5
12+
Set-StrictMode -Version 5
1313

1414
function Invoke-MimikatzNetwork {
1515
<#
@@ -56,4 +56,4 @@ function Invoke-MimikatzNetwork {
5656
$EndMessage = "[*] $Time - $ComputerName done"
5757
$EndMessage | Tee-Object -Append -FilePath $Protocol
5858
}
59-
}
59+
}

‎PowerShellUtilities.psd1

176 Bytes
Binary file not shown.

‎Select-MimikatzDomainAccounts.ps1

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
<#
2+
ScipUtilities provides various utility commandlets.
3+
4+
Author: Eleanore Young, Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2017 Eleanore Young, Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
11+
#Requires -Version 5
12+
Set-StrictMode -Version 5
13+
14+
function New-DomainAccountEntry {
15+
[CmdletBinding()]
16+
Param (
17+
[ValidateNotNullOrEmpty()]
18+
[String]
19+
$Domain,
20+
21+
[ValidateNotNullOrEmpty()]
22+
[String]
23+
$Username,
24+
25+
[AllowEmptyString()]
26+
[String]
27+
$Password,
28+
29+
[AllowEmptyString()]
30+
[String]
31+
$NtlmHash,
32+
33+
[AllowEmptyString()]
34+
[String]
35+
$Sha1Hash
36+
)
37+
38+
New-Object -TypeName PSObject -Prop @{
39+
'Domain' = $Domain.ToUpper();
40+
'Username' = $Username;
41+
'Password' = $Password;
42+
'NTLM' = $NtlmHash;
43+
'SHA1' = $Sha1Hash;
44+
}
45+
}
46+
47+
48+
function Select-MimikatzDomainAccounts {
49+
<#
50+
.SYNOPSIS
51+
Extract passwords or password hashes from Mimikatz log files. Developed for Mimikatz version 2.0 alpha.
52+
53+
.PARAMETER Path
54+
Choose the path or GLOB pattern that tells the function which files to search.
55+
56+
.PARAMETER HashcatSelect
57+
Choose to look for either passwords or hashes (ntlm and sha1).
58+
59+
.PARAMETER OutputTo
60+
Output the results either to the console, to a format parseable in hashcat, or to CSV.
61+
#>
62+
[CmdletBinding()]
63+
Param (
64+
[ValidateNotNullOrEmpty()]
65+
[String]
66+
$Path = "*.log",
67+
68+
[ValidateSet("console", "hashcat", "csv")]
69+
[String]
70+
$OutputTo = "console",
71+
72+
[ValidateSet("ntlm", "sha1")]
73+
[String]
74+
$HashcatSelect = "ntlm"
75+
)
76+
77+
$DomainPasswordRegex = "\s+\*\s+Username\s+:\s+(?<username>[-_a-zA-Z0-9]+)[\r\n]+\s+\*\s+Domain\s+:\s+(?<domain>[a-zA-Z0-9]+)[\r\n]+\s+\*\s+Password\s+:\s+(?<password>(?!\(null\)).*)[\r\n]+"
78+
$DomainHashRegex = "\s+\*\s+Username\s+:\s+(?<username>[-_a-zA-Z0-9]+)[\r\n]+\s+\*\s+Domain\s+:\s+(?<domain>[a-zA-Z0-9]+)[\r\n]+(\s+\*\sFlags\s+:\s+.*[\r\n]+)?\s+\*\s+NTLM\s+:\s+(?<ntlm>[0-9a-fA-F]+)[\r\n]+\s+\*\sSHA1\s+:\s+(?<sha1>[0-9a-fA-F]+)[\r\n]+"
79+
80+
$DomainAccounts = @{}
81+
Foreach ($LogFile in Get-ChildItem -Recurse $Path) {
82+
$Content = Get-Content -Raw -Path $LogFile
83+
84+
$DomainPasswordMatches = Select-String -InputObject $Content -AllMatches -Pattern $DomainPasswordRegex
85+
if ($DomainPasswordMatches -ne $null) {
86+
Foreach ($Match in $DomainPasswordMatches.Matches) {
87+
$g = $Match.Groups
88+
$Username = $g["username"].Value
89+
if (!$DomainAccounts.ContainsKey($Username)) {
90+
$SearchEntry = New-DomainAccountEntry -Domain $g["domain"].Value -Username $Username -Password $g["password"].Value
91+
$DomainAccounts.Add($Username, $SearchEntry)
92+
} else {
93+
$SearchEntry = $DomainAccounts.Get_Item($Username)
94+
$SearchEntry.Password = $g["password"].Value
95+
$DomainAccounts.Set_Item($Username, $SearchEntry)
96+
}
97+
}
98+
}
99+
100+
$DomainHashMatches = Select-String -InputObject $Content -AllMatches -Pattern $DomainHashRegex
101+
if ($DomainHashMatches -ne $null) {
102+
Foreach ($Match in $DomainHashMatches.Matches) {
103+
$g = $Match.Groups
104+
$Username = $g["username"].Value
105+
if (!$DomainAccounts.ContainsKey($Username)) {
106+
$SearchEntry = New-DomainAccountEntry -Domain $g["domain"].Value -Username $Username -NtlmHash $g["ntlm"].Value -Sha1Hash $g["sha1"].Value
107+
$DomainAccounts.Add($Username, $SearchEntry)
108+
} else {
109+
$SearchEntry = $DomainAccounts.Get_Item($Username)
110+
$SearchEntry.NTLM = $g["ntlm"].Value
111+
$SearchEntry.SHA1 = $g["sha1"].Value
112+
$DomainAccounts.Set_Item($Username, $SearchEntry)
113+
}
114+
}
115+
}
116+
}
117+
118+
if ($DomainAccounts.Count -eq 0) {
119+
Write-Warning "Could not find any domain accounts."
120+
} else {
121+
$DomainAccounts = ($DomainAccounts.Values | Sort-Object -Property Username)
122+
}
123+
124+
if ($OutputTo -eq "csv") {
125+
$DomainAccounts | ConvertTo-Csv -NoTypeInformation
126+
} elseif ($OutputTo -eq "hashcat") {
127+
if ($HashcatSelect -eq "ntlm") {
128+
Foreach ($Entry in $DomainAccounts) {
129+
$Entry.Username + ":" + $Entry.NTLM
130+
}
131+
} elseif ($HashcatSelect -eq "sha1") {
132+
Foreach ($Entry in $DomainAccounts) {
133+
$Entry.Username + ":" + $Entry.SHA1
134+
}
135+
} else {
136+
throw "Format '$HashcatSelect' doesn't make sense for hashcat output."
137+
}
138+
} else {
139+
$DomainAccounts | Format-Table
140+
}
141+
}

‎Select-MimikatzLocalAccounts.ps1

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
<#
2+
ScipUtilities provides various utility commandlets.
3+
4+
Author: Eleanore Young, Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2017 Eleanore Young, Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
11+
#Requires -Version 5
12+
Set-StrictMode -Version 5
13+
14+
function New-LocalAccountEntry {
15+
[CmdletBinding()]
16+
Param (
17+
[ValidateNotNullOrEmpty()]
18+
[String]
19+
$Hostname,
20+
21+
[ValidateNotNullOrEmpty()]
22+
[String]
23+
$Username,
24+
25+
[AllowEmptyString()]
26+
[String]
27+
$LmHash,
28+
29+
[AllowEmptyString()]
30+
[String]
31+
$NtlmHash
32+
)
33+
34+
New-Object -TypeName PSObject -Prop @{
35+
'Hostname' = $Hostname;
36+
'Username' = $Username;
37+
'LM' = $LmHash;
38+
'NTLM' = $NtlmHash;
39+
}
40+
}
41+
42+
function Select-MimikatzLocalAccounts {
43+
<#
44+
.SYNOPSIS
45+
Extract passwords or password hashes from Mimikatz log files. Developed for Mimikatz version 2.0 alpha.
46+
47+
.PARAMETER Path
48+
Choose the path or GLOB pattern that tells the function which files to search.
49+
50+
.PARAMETER HashcatSelect
51+
Choose to look for either passwords or hashes (ntlm and sha1).
52+
53+
.PARAMETER OutputTo
54+
Output the results either to the console, to a format parseable in hashcat, or to CSV.
55+
#>
56+
[CmdletBinding()]
57+
Param (
58+
[ValidateNotNullOrEmpty()]
59+
[String]
60+
$Path = "*.log",
61+
62+
[ValidateSet("console", "hashcat", "csv")]
63+
[String]
64+
$OutputTo = "console",
65+
66+
[ValidateSet("ntlm", "lm")]
67+
[String]
68+
$HashcatSelect = "ntlm"
69+
)
70+
71+
$LocalHashRegex = "lsadump::sam[\r\n]+Domain\s+:\s+(?<host>[-_a-zA-Z0-9]+)[\r\n]+SysKey.*[\r\n]+Local\sSID.*[\r\n]+SAMKey.*[\r\n]+(?:RID.*[\r\n]*User\s+:\s+(?<username>[-_a-zA-Z0-9]+)[\r\n]+LM\s+:\s+(?<lm>[0-9a-fA-F]*)[\r\n]+NTLM\s+:\s+(?<ntlm>[0-9a-fA-F]*)[\r\n]+)+"
72+
73+
$LocalAccounts = New-Object System.Collections.Generic.List[System.Object]
74+
Foreach ($LogFile in Get-ChildItem -Recurse $Path) {
75+
$Content = Get-Content -Raw -Path $LogFile
76+
77+
$LocalHashMatches = Select-String -InputObject $Content -AllMatches -Pattern $LocalHashRegex
78+
if ($LocalHashMatches -ne $null) {
79+
Foreach ($Match in $LocalHashMatches.Matches) {
80+
$Hostname = $Match.Groups["host"].Value
81+
For ($i=0; $i -lt $Match.Groups["username"].Captures.Count; $i++) {
82+
$Username = $Match.Groups["username"].Captures[$i].Value
83+
$LmHash = $Match.Groups["lm"].Captures[$i].Value
84+
$NtlmHash = $Match.Groups["ntlm"].Captures[$i].Value
85+
$SearchEntry = New-LocalAccountEntry -Hostname $Hostname -Username $Username -LmHash $LmHash -NtlmHash $NtlmHash
86+
$LocalAccounts.Add($SearchEntry)
87+
}
88+
}
89+
}
90+
}
91+
92+
if ($LocalAccounts.Count -eq 0) {
93+
Write-Warning "Could not find any local accounts with password hashes."
94+
}
95+
96+
if ($OutputTo -eq "csv") {
97+
$LocalAccounts | ConvertTo-Csv -NoTypeInformation
98+
} elseif ($OutputTo -eq "hashcat") {
99+
if ($HashcatSelect -eq "ntlm") {
100+
Foreach ($Entry in $LocalAccounts) {
101+
$Entry.Username + ":" + $Entry.NTLM
102+
}
103+
} elseif ($HashcatSelect -eq "lm") {
104+
Foreach ($Entry in $LocalAccounts) {
105+
$Entry.Username + ":" + $Entry.LM
106+
}
107+
} else {
108+
throw "Format '$HashcatSelect' doesn't make sense for hashcat output."
109+
}
110+
} else {
111+
$LocalAccounts | Format-Table
112+
}
113+
}

‎Select-MimikatzPasswords.ps1

Lines changed: 0 additions & 102 deletions
This file was deleted.

0 commit comments

Comments
 (0)