Skip to content

Instantly share code, notes, and snippets.

@ChoiSG
Created March 11, 2020 21:15
Show Gist options
  • Save ChoiSG/c12a22348f37c22010d87c0d50f691a3 to your computer and use it in GitHub Desktop.
Save ChoiSG/c12a22348f37c22010d87c0d50f691a3 to your computer and use it in GitHub Desktop.
Parsing mimikatz output - simplified
# Author: Will Schroeder (https://github.com/PowerShellEmpire/PowerTools/blob/master/PewPewPew/Invoke-MassMimikatz.ps1)
# modification: choisg - Very little modification has been done to simplify the output
# helper to parse out Mimikatz output
function Parse-Mimikatz {
[CmdletBinding()]
param(
[string]$raw
)
# msv
$results = $raw | Select-String -Pattern "(?s)(?<=msv :).*?(?=tspkg :)" -AllMatches | %{$_.matches} | %{$_.value} | Sort-Object -Unique
if($results){
foreach($match in $results){
if($match.Contains("Domain")){
$lines = $match.split("`n")
foreach($line in $lines){
if ($line.Contains("Username")){
$username = $line.split(":")[1].trim()
}
elseif ($line.Contains("Domain")){
$domain = $line.split(":")[1].trim()
}
elseif ($line.Contains("NTLM")){
$password = $line.split(":")[1].trim()
}
}
if ($password -and $($password -ne "(null)") -and $password.length -lt 100){
$username+"/"+$domain+":"+$password
}
}
}
}
$results = $raw | Select-String -Pattern "(?s)(?<=tspkg :).*?(?=wdigest :)" -AllMatches | %{$_.matches} | %{$_.value} | Sort-Object -Unique
if($results){
foreach($match in $results){
if($match.Contains("Domain")){
$lines = $match.split("`n")
foreach($line in $lines){
if ($line.Contains("Username")){
$username = $line.split(":")[1].trim()
}
elseif ($line.Contains("Domain")){
$domain = $line.split(":")[1].trim()
}
elseif ($line.Contains("Password")){
$password = $line.split(":")[1].trim()
}
}
if ($password -and $($password -ne "(null)") -and $password.length -lt 100){
$username+"/"+$domain+":"+$password
}
}
}
}
$results = $raw | Select-String -Pattern "(?s)(?<=wdigest :).*?(?=kerberos :)" -AllMatches | %{$_.matches} | %{$_.value} | Sort-Object -Unique
if($results){
foreach($match in $results){
if($match.Contains("Domain")){
$lines = $match.split("`n")
foreach($line in $lines){
if ($line.Contains("Username")){
$username = $line.split(":")[1].trim()
}
elseif ($line.Contains("Domain")){
$domain = $line.split(":")[1].trim()
}
elseif ($line.Contains("Password")){
$password = $line.split(":")[1].trim()
}
}
if ($password -and $($password -ne "(null)") -and $password.length -lt 100){
$username+"/"+$domain+":"+$password
}
}
}
}
$results = $raw | Select-String -Pattern "(?s)(?<=kerberos :).*?(?=ssp :)" -AllMatches | %{$_.matches} | %{$_.value} | Sort-Object -Unique
if($results){
foreach($match in $results){
if($match.Contains("Domain")){
$lines = $match.split("`n")
foreach($line in $lines){
if ($line.Contains("Username")){
$username = $line.split(":")[1].trim()
}
elseif ($line.Contains("Domain")){
$domain = $line.split(":")[1].trim()
}
elseif ($line.Contains("Password")){
$password = $line.split(":")[1].trim()
}
}
if ($password -and $($password -ne "(null)") -and $password.length -lt 100){
$username+"/"+$domain+":"+$password
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment