From c5168cdba6a3b2d7dd8d79c8ac9583d3ace6a504 Mon Sep 17 00:00:00 2001 From: mattifestation Date: Mon, 3 Feb 2014 17:13:35 -0500 Subject: Removed mimikatz. This doesn't need to reside in PowerSploit. Those that are truly paranoid should validate that the embedded executable in Invoke-Mimikatz.ps1 is indeed mimikatz. This was causing AV to flag upon downloading PowerSploit. --- .../mimikatz/modules/Security Packages/wdigest.h | 29 ---------------------- 1 file changed, 29 deletions(-) delete mode 100644 Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h (limited to 'Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h') diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h deleted file mode 100644 index 9db3c8b..0000000 --- a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h +++ /dev/null @@ -1,29 +0,0 @@ -/* Benjamin DELPY `gentilkiwi` - http://blog.gentilkiwi.com - benjamin@gentilkiwi.com - Licence : http://creativecommons.org/licenses/by/3.0/fr/ - Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ -*/ -#pragma once -#include "../mod_mimikatz_sekurlsa.h" - -class mod_mimikatz_sekurlsa_wdigest { - -private: - typedef struct _KIWI_WDIGEST_LIST_ENTRY { - struct _KIWI_WDIGEST_LIST_ENTRY *Flink; - struct _KIWI_WDIGEST_LIST_ENTRY *Blink; - DWORD UsageCount; - struct _KIWI_WDIGEST_LIST_ENTRY *This; - LUID LocallyUniqueIdentifier; - } KIWI_WDIGEST_LIST_ENTRY, *PKIWI_WDIGEST_LIST_ENTRY; - - static PKIWI_WDIGEST_LIST_ENTRY l_LogSessList; - static long offsetWDigestPrimary; - static bool searchWDigestEntryList(); - -public: - static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModWDIGEST; - static bool getWDigest(vector * arguments); - static bool WINAPI getWDigestLogonData(__in PLUID logId, __in bool justSecurity); -}; \ No newline at end of file -- cgit v1.2.3