From c5168cdba6a3b2d7dd8d79c8ac9583d3ace6a504 Mon Sep 17 00:00:00 2001 From: mattifestation Date: Mon, 3 Feb 2014 17:13:35 -0500 Subject: Removed mimikatz. This doesn't need to reside in PowerSploit. Those that are truly paranoid should validate that the embedded executable in Invoke-Mimikatz.ps1 is indeed mimikatz. This was causing AV to flag upon downloading PowerSploit. --- Exfiltration/mimikatz-1.0/driver/mod_memory.c | 32 --------------------------- 1 file changed, 32 deletions(-) delete mode 100644 Exfiltration/mimikatz-1.0/driver/mod_memory.c (limited to 'Exfiltration/mimikatz-1.0/driver/mod_memory.c') diff --git a/Exfiltration/mimikatz-1.0/driver/mod_memory.c b/Exfiltration/mimikatz-1.0/driver/mod_memory.c deleted file mode 100644 index d5a05b3..0000000 --- a/Exfiltration/mimikatz-1.0/driver/mod_memory.c +++ /dev/null @@ -1,32 +0,0 @@ -#include "mod_memory.h" - -NTSTATUS searchMemory(const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, PUCHAR *addressePattern, SIZE_T longueur) -{ - for(*addressePattern = adresseBase; (adresseMaxMin > adresseBase) ? (*addressePattern <= adresseMaxMin) : (*addressePattern >= adresseMaxMin); *addressePattern += (adresseMaxMin > adresseBase) ? 1 : -1) - { - if(RtlCompareMemory(pattern, *addressePattern, longueur) == longueur) - { - return STATUS_SUCCESS; - } - } - *addressePattern = NULL; - return STATUS_NOT_FOUND; -} - -NTSTATUS genericPointerSearch(PUCHAR *addressePointeur, const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, SIZE_T longueur, LONG offsetTo) -{ - NTSTATUS status = searchMemory(adresseBase, adresseMaxMin, pattern, addressePointeur, longueur); - if(NT_SUCCESS(status)) - { - *addressePointeur += offsetTo; - #ifdef _M_X64 - *addressePointeur += sizeof(LONG) + *(PLONG)(*addressePointeur); - #elif defined _M_IX86 - *addressePointeur = *(PUCHAR *)(*addressePointeur); - #endif - - if(!*addressePointeur) - status = STATUS_INVALID_HANDLE; - } - return status; -} -- cgit v1.2.3