From c5168cdba6a3b2d7dd8d79c8ac9583d3ace6a504 Mon Sep 17 00:00:00 2001 From: mattifestation Date: Mon, 3 Feb 2014 17:13:35 -0500 Subject: Removed mimikatz. This doesn't need to reside in PowerSploit. Those that are truly paranoid should validate that the embedded executable in Invoke-Mimikatz.ps1 is indeed mimikatz. This was causing AV to flag upon downloading PowerSploit. --- .../librairies/klock/Win32/CL.read.1.tlog | Bin 125158 -> 0 bytes .../librairies/klock/Win32/CL.write.1.tlog | Bin 3668 -> 0 bytes .../librairies/klock/Win32/cl.command.1.tlog | Bin 5964 -> 0 bytes .../klock/Win32/klock.dll.intermediate.manifest | 10 -- .../librairies/klock/Win32/klock.lastbuildstate | 2 - .../mimikatz-1.0/librairies/klock/Win32/klock.res | Bin 740 -> 0 bytes .../librairies/klock/Win32/klock.write.1.tlog | 5 - .../librairies/klock/Win32/link-cvtres.read.1.tlog | 1 - .../klock/Win32/link-cvtres.write.1.tlog | 1 - .../librairies/klock/Win32/link.command.1.tlog | Bin 2494 -> 0 bytes .../librairies/klock/Win32/link.read.1.tlog | Bin 4222 -> 0 bytes .../librairies/klock/Win32/link.write.1.tlog | Bin 1570 -> 0 bytes .../librairies/klock/Win32/mt.command.1.tlog | Bin 934 -> 0 bytes .../librairies/klock/Win32/mt.read.1.tlog | Bin 1098 -> 0 bytes .../librairies/klock/Win32/mt.write.1.tlog | Bin 578 -> 0 bytes .../librairies/klock/Win32/rc.command.1.tlog | Bin 630 -> 0 bytes .../librairies/klock/Win32/rc.read.1.tlog | Bin 2532 -> 0 bytes .../librairies/klock/Win32/rc.write.1.tlog | Bin 374 -> 0 bytes .../mimikatz-1.0/librairies/klock/klock.cpp | 97 --------------- Exfiltration/mimikatz-1.0/librairies/klock/klock.h | 14 --- .../mimikatz-1.0/librairies/klock/klock.rc | Bin 1866 -> 0 bytes .../mimikatz-1.0/librairies/klock/klock.vcxproj | 131 --------------------- .../librairies/klock/klock.vcxproj.filters | 53 --------- 23 files changed, 314 deletions(-) delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/klock.h delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/klock.rc delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj delete mode 100644 Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters (limited to 'Exfiltration/mimikatz-1.0/librairies/klock') diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog deleted file mode 100644 index bcd26b3..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog deleted file mode 100644 index 73eaec6..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog deleted file mode 100644 index 5cef6b9..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest deleted file mode 100644 index ecea6f7..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - - diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate deleted file mode 100644 index 4d28193..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate +++ /dev/null @@ -1,2 +0,0 @@ -#v4.0:v100 -Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res deleted file mode 100644 index 3104953..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog deleted file mode 100644 index 3cfbe7b..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog +++ /dev/null @@ -1,5 +0,0 @@ -^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\librairies\klock\klock.vcxproj -C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.lib -C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.lib -C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.exp -C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.exp diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog deleted file mode 100644 index 46b134b..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog +++ /dev/null @@ -1 +0,0 @@ -ÿþ \ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog deleted file mode 100644 index 46b134b..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog +++ /dev/null @@ -1 +0,0 @@ -ÿþ \ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog deleted file mode 100644 index 966e3ca..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog deleted file mode 100644 index 118ff20..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog deleted file mode 100644 index ed695be..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog deleted file mode 100644 index 96b5f5a..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog deleted file mode 100644 index 6e3ab6c..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog deleted file mode 100644 index df7edcc..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog deleted file mode 100644 index 055dfdc..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog deleted file mode 100644 index ee2aaa1..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog deleted file mode 100644 index a07a6d6..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp b/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp deleted file mode 100644 index 9717c49..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp +++ /dev/null @@ -1,97 +0,0 @@ -/* Benjamin DELPY `gentilkiwi` - http://blog.gentilkiwi.com - benjamin@gentilkiwi.com - Licence : http://creativecommons.org/licenses/by/3.0/fr/ -*/ -#include "klock.h" - -__kextdll bool __cdecl getDescription(wstring * maDescription) -{ - maDescription->assign(L"kLock : librairie de manipulation des bureaux"); - return true; -} - -bool getNameOfDesktop(HDESK desktop, wstring &bureau) -{ - bool resultat = false; - - wchar_t * monBuffer; - DWORD tailleRequise = 0; - - if(!GetUserObjectInformation(desktop, UOI_NAME, NULL, 0, &tailleRequise) && (tailleRequise > 0)) - { - monBuffer = new wchar_t[tailleRequise]; - if(resultat = (GetUserObjectInformation(desktop, UOI_NAME, monBuffer, tailleRequise, &tailleRequise) != 0)) - { - bureau.assign(monBuffer); - } - delete[] monBuffer; - } - return resultat; -} - -__kextdll bool __cdecl echange(mod_pipe * monPipe, vector * mesArguments) -{ - wstringstream maReponse; - wstring source, cible, monBureau; - bool modeFullAuto = true; - - if(mesArguments->size() == 2) - { - modeFullAuto = false; - source = mesArguments->front(); - cible = mesArguments->back(); - } - - if (HDESK hOriginalDesktop = OpenInputDesktop(0, FALSE, GENERIC_READ | DESKTOP_SWITCHDESKTOP)) - { - if(getNameOfDesktop(hOriginalDesktop, monBureau)) - { - maReponse << L"Bureau courant : " << monBureau << endl; - - if((_wcsicmp(monBureau.c_str(), source.c_str()) == 0) || modeFullAuto) - { - if(modeFullAuto) - cible = _wcsicmp(monBureau.c_str(), L"Default") == 0 ? L"WinLogon" : L"Default"; - - maReponse << L"Bureau cible : " << cible << endl; - - if (HDESK hNewDesktop = OpenDesktop(cible.c_str(), 0, FALSE, DESKTOP_SWITCHDESKTOP)) - { - if (SwitchDesktop(hNewDesktop)) - maReponse << L"Switch du bureau réussi !"; - else - maReponse << L"Erreur : impossible de basculer le bureau ; SwitchDesktop : " << mod_system::getWinError(); - maReponse << endl; - CloseDesktop(hNewDesktop); - } - else maReponse << "Erreur : impossible d\'ouvrir le bureau cible (" << cible << L") ; OpenDesktop : " << mod_system::getWinError(); - } - else if(!modeFullAuto) - maReponse << L"Erreur : le bureau courant (" << monBureau << L") ne correspond pas au bureau source indiqué (" << source << L")" << endl; - } - else maReponse << L"Erreur : impossible d\'obtenir le nom du bureau courant ; getNameOfDesktop : " << mod_system::getWinError() << endl; - - CloseDesktop(hOriginalDesktop); - } - else maReponse << L"Erreur : impossible d\'ouvrir le bureau courant ; OpenInputDesktop : " << mod_system::getWinError() << endl; - - return sendTo(monPipe, maReponse.str()); -} - -__kextdll bool __cdecl getDesktop(mod_pipe * monPipe, vector * mesArguments) -{ - wstringstream maReponse; - wstring monBureau; - - if (HDESK hDesktop = OpenInputDesktop(0, FALSE, GENERIC_READ)) - { - if(getNameOfDesktop(hDesktop, monBureau)) - maReponse << L"Bureau courant : " << monBureau << endl; - else - maReponse << L"Erreur : impossible d\'obtenir le nom du bureau courant ; getNameOfDesktop : " << mod_system::getWinError() << endl; - - CloseDesktop(hDesktop); - } - return sendTo(monPipe, maReponse.str()); -} \ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.h b/Exfiltration/mimikatz-1.0/librairies/klock/klock.h deleted file mode 100644 index e6ea046..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/klock.h +++ /dev/null @@ -1,14 +0,0 @@ -/* Benjamin DELPY `gentilkiwi` - http://blog.gentilkiwi.com - benjamin@gentilkiwi.com - Licence : http://creativecommons.org/licenses/by/3.0/fr/ -*/ -#pragma once -#include "kmodel.h" -#include "mod_system.h" - -__kextdll bool __cdecl getDescription(wstring * maDescription); - -bool getNameOfDesktop(HDESK desktop, wstring &bureau); -__kextdll bool __cdecl echange(mod_pipe * monPipe, vector * mesArguments); -__kextdll bool __cdecl getDesktop(mod_pipe * monPipe, vector * mesArguments); \ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc b/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc deleted file mode 100644 index 28599d2..0000000 Binary files a/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc and /dev/null differ diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj deleted file mode 100644 index a93a79d..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj +++ /dev/null @@ -1,131 +0,0 @@ - - - - - Release - Win32 - - - Release - x64 - - - - {6556249E-1C80-4047-A863-F608C8B8AC55} - Win32Proj - klock - - - - DynamicLibrary - false - true - Unicode - Static - - - DynamicLibrary - false - true - Unicode - Static - - - - - - - - - - - - - false - $(SolutionDir)$(Platform)\ - $(Platform)\ - - - false - $(SolutionDir)$(Platform)\ - $(Platform)\ - - - - Level3 - NotUsing - Full - true - true - WIN32;NDEBUG;_WINDOWS;_USRDLL;KLOCK_EXPORTS;%(PreprocessorDefinitions) - $(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories) - Size - true - false - Fast - false - false - None - - - Windows - false - true - true - user32.lib;shlwapi.lib;secur32.lib - NoErrorReport - - - 0x040c - - - - - Level3 - NotUsing - Full - true - true - WIN32;NDEBUG;_WINDOWS;_USRDLL;KLOCK_EXPORTS;%(PreprocessorDefinitions) - $(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories) - Size - true - false - Fast - false - false - None - - - Windows - false - true - true - user32.lib;shlwapi.lib;secur32.lib - NoErrorReport - - - 0x040c - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters deleted file mode 100644 index cc5f342..0000000 --- a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters +++ /dev/null @@ -1,53 +0,0 @@ - - - - - {255a8a01-9f58-4a47-9d1e-1d5fc9f16419} - - - {d6070dc8-7a9b-46c0-b75a-5fd6c10f8613} - - - {01639990-b135-46fe-8511-84761977c1bf} - - - {fa3fed71-2d05-4e39-a46b-59e9b2c83e04} - - - {e53f7390-cd26-41d0-9f10-ea350fc88e43} - - - - - Modules Communs\Communication - - - Modules Communs\Parseur - - - Modules Communs\Librairie Modèle - - - - Modules Communs\System - - - - - Modules Communs\Communication - - - Modules Communs\Parseur - - - Modules Communs\Librairie Modèle - - - - Modules Communs\System - - - - - - \ No newline at end of file -- cgit v1.2.3