S3cur3Th1sSh1t/WinPwn

I am unable to get NTLM Hashes using Inveigh using WinPwn

Open

#44 opened on Jul 10, 2022

View on GitHub
 (5 comments) (0 reactions) (0 assignees)PowerShell (540 forks)batch import
help wanted

Repository metrics

Stars
 (3,663 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

I did check the directory but no file is created. Nothing that shows the ntlm hashes. I tried editing the invoke-Inveigh command with FileOutput -Disabled but still couldn't make it work. Are there any logs that I can share? I did see that the Inveigh module of WinPwn would open a new PS Script process but going through some earlier issues (posted in Github), I learned that AMSI bypass was not getting applied to Inveigh. So I assume that Inveigh loads and runs on the existing PS session but still I am unable to get the NTLM hashes. No output file in the Directory.

Any help would be greatly appreciated!

Contributor guide

Research direction
Check if the AMSI bypass is being applied to the Inveigh command, verify the file output directory permissions, and test with a minimal Inveigh command to isolate the issue.
Tech stack
shell
Domain
security
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
PowerShellWindows
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40