Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 9f78286

Browse files
author
Matt Graeber
committed
Merge pull request #77 from clymb3r/master
Fix for multi-processor systems
2 parents 03ed2ad + 235af29 commit 9f78286

File tree

1 file changed

+18
-1
lines changed

1 file changed

+18
-1
lines changed

Exfiltration/Invoke-Mimikatz.ps1

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2586,8 +2586,25 @@ $RemoteScriptBlock = {
25862586
#Load the PE reflectively
25872587
Write-Verbose "Calling Invoke-MemoryLoadLibrary"
25882588

2589-
if (((Get-WmiObject -Class Win32_Processor).AddressWidth / 8) -ne [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]))
2589+
try
25902590
{
2591+
$Processors = Get-WmiObject -Class Win32_Processor
2592+
}
2593+
catch
2594+
{
2595+
throw ($_.Exception)
2596+
}
2597+
2598+
if ($Processors -is [array])
2599+
{
2600+
$Processor = $Processors[0]
2601+
} else {
2602+
$Processor = $Processors
2603+
}
2604+
2605+
if ( ( $Processor.AddressWidth) -ne (([System.IntPtr]::Size)*8) )
2606+
{
2607+
Write-Verbose ( "Architecture: " + $Processor.AddressWidth + " Process: " + ([System.IntPtr]::Size * 8))
25912608
Write-Error "PowerShell architecture (32bit/64bit) doesn't match OS architecture. 64bit PS must be used on a 64bit OS." -ErrorAction Stop
25922609
}
25932610

0 commit comments

Comments
 (0)