Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit b684da0

Browse files
committed
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
Added a check to ensure the script isn't being run from Session0 with the "NewWinLogon" flag. This flag does not work in Session0 because winlogon.exe tries to load stuff from user32.dll which requires a desktop is present. This is not possible in Session0 because there is no desktop/GUI, so it causes winlogon to load and then immediately close with error code c0000142 indicating a DLL failed to initialize. There is no way to fix this that I know of, if you need to run the script from Session0 use the "ExistingWinLogon" flag.
1 parent bb41ab9 commit b684da0

File tree

5 files changed

+3432
-3423
lines changed

5 files changed

+3432
-3423
lines changed

Exfiltration/Exfiltration.psd1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
7575
# List of all files packaged with this module
7676
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
7777
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
78-
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Inject-LogonCredentials.ps1'
78+
'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Invoke-CredentialInjection.ps1'
7979

8080
# Private data to pass to the module specified in RootModule/ModuleToProcess
8181
# PrivateData = ''

0 commit comments

Comments
 (0)