From 59cd18360764af6e6133ad11ec9cd8295372e587 Mon Sep 17 00:00:00 2001 From: clymb3r Date: Tue, 1 Oct 2013 09:47:05 -0700 Subject: Adding Invoke-Mimikatz and Invoke-Ninjacopy --- .../mimikatz/modules/mod_mimikatz_nogpo.h | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h (limited to 'Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h') diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h new file mode 100644 index 0000000..c96e22f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h @@ -0,0 +1,30 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_patch.h" +#include + +class mod_mimikatz_nogpo +{ +private: + static bool disableSimple(wstring commandLine, wstring origKey, wstring kiwiKey, DWORD * monPID = NULL); + static bool disableSimple(wstring commandLine, string origKey, string kiwiKey, DWORD * monPID = NULL); + static bool disableSimple(wstring commandLine, SIZE_T taillePattern, PBYTE maCleDeDepart, const void * maCleFinale, DWORD * monPID = NULL); + + static bool getApplicationPathFromCLSID(wstring application, wstring * path); + +public: + static vector getMimiKatzCommands(); + + static bool regedit(vector * arguments); + static bool cmd(vector * arguments); + static bool taskmgr(vector * arguments); + static bool olpst(vector * arguments); +}; + -- cgit v1.2.3