tandasat

function Invoke-Mimikidz
{
<#
.SYNOPSIS

This script leverages Mimikatz 2.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as
dump credentials without ever writing the mimikatz binary to disk. 
The script has a ComputerName parameter which allows it to be executed against multiple computers.

This script should be able to dump credentials from any version of Windows through Windows 8.1 that has PowerShell v2 or higher installed.

tandasat

#include <stdio.h>
#include <string.h>
#include "lib.h"
#include <Wininet.h>
//#include "starter.h"

//include OTF
#include "font.h" // foofont is fetched from loader config struct 

//#include "cert.h"

tandasat

Susupended because of other project.

///////////////////////////////////////////////////////////////////////////////
//
// p123
//

I used Windows 8 kernel version 16628.

//////////////////////////////// 1-6

tandasat

///////////////////////////////////////////////////////////////////////////////
//
// p11
//

//////////////////////////////// 1
; ASM
edi = s->0x8_charp
edx = edi
eax = 0

tandasat

set TARGET_BXRC=bochsrc2.4.6
set BXSHARE=C:\Program Files (x86)\Bochs-2.4.6
set IDABASE=C:\Program Files (x86)\IDA

"%IDABASE%\idaq.exe" -c -A -OIDAPython:mbr.py %TARGET_BXRC%.bxrc
"%IDABASE%\idaq.exe" -rbochs %TARGET_BXRC%.idb

tandasat

# configuration file generated by Bochs
plugin_ctrl: unmapped=1, biosdev=1, speaker=1, extfpuirq=1, gameport=1, pci_ide=1, acpi=1, ioapic=1
config_interface: win32config
display_library: win32, options="gui_debug"
memory: host=1024, guest=1024
romimage: file="C:\Program Files (x86)\Bochs-2.4.6\BIOS-bochs-latest"
vgaromimage: file="C:\Program Files (x86)\Bochs-2.4.6\VGABIOS-lgpl-latest"
boot: cdrom, disk
floppy_bootsig_check: disabled=0
# no floppya