Removed mimikatz.

This doesn't need to reside in PowerSploit. Those that are truly
paranoid should validate that the embedded executable in
Invoke-Mimikatz.ps1 is indeed mimikatz.

This was causing AV to flag upon downloading PowerSploit.

1 files changed, 0 insertions, 32 deletions

diff --git a/Exfiltration/mimikatz-1.0/driver/mod_memory.c b/Exfiltration/mimikatz-1.0/driver/mod_memory.c
deleted file mode 100644
index d5a05b3..0000000
--- a/Exfiltration/mimikatz-1.0/driver/mod_memory.c
+++ /dev/null
@@ -1,32 +0,0 @@
-#include "mod_memory.h"
-
-NTSTATUS searchMemory(const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, PUCHAR *addressePattern, SIZE_T longueur)
-{
-	for(*addressePattern = adresseBase; (adresseMaxMin > adresseBase) ? (*addressePattern <= adresseMaxMin) : (*addressePattern >= adresseMaxMin); *addressePattern += (adresseMaxMin > adresseBase) ? 1 : -1)
-	{
-		if(RtlCompareMemory(pattern, *addressePattern, longueur) == longueur)
-		{
-			return STATUS_SUCCESS;
-		}
-	}
-	*addressePattern = NULL;
-	return STATUS_NOT_FOUND;
-}
-
-NTSTATUS genericPointerSearch(PUCHAR *addressePointeur, const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, SIZE_T longueur, LONG offsetTo)
-{
-	NTSTATUS status = searchMemory(adresseBase, adresseMaxMin, pattern, addressePointeur, longueur);
-	if(NT_SUCCESS(status))
-	{
-		*addressePointeur += offsetTo;
-		#ifdef _M_X64
-			*addressePointeur += sizeof(LONG) + *(PLONG)(*addressePointeur);
-		#elif defined _M_IX86
-			*addressePointeur = *(PUCHAR *)(*addressePointeur);
-		#endif
-		
-		if(!*addressePointeur)
-			status = STATUS_INVALID_HANDLE;
-	}
-	return status;
-}