netwrix / poshkatz Goto Github PK

It seems like our output needs trimming. Using an -eq against the formatted output of many of the commands will not work properly without a trim...

Example

DOESN'T WORK!: $LogonPasswords = Get-MKLogonPassword | Where-Object { $_.UserName -eq $TargetUserName

DOES WORK!: $LogonPasswords = Get-MKLogonPassword | Where-Object { $_.UserName.Trim() -eq $TargetUserName

}

This isn't horrible but can be frustrating - should clean this up.

ORIGINAL MIMIKATZ OUTPUT

^^^ Notice NTLM Values

SAME MACHINE - SAME EVERYTHING

https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107

This module really has no documentation - the Readme should be updated will at the very least a light documentation with common use cases and examples!