updating mimikatz...

[jun0s]

I always update mimikatz, but since this change... "gentilkiwi/mimikatz@8159455"
(new sid module)

this happens locally;

PS C:\Users\userxs> invoke-mimikatz
New function reference is null, this is almost certainly a bug in this script. Function: 73. Dll: WLDAP32.dll
En C:\Windows\system32\WindowsPowerShell\v1.0\Modules\powersploit\Exfiltration\Invoke-Mimikatz.ps1: 1714 Carácter: 7

• ... Throw "New function reference is null, this is almost cer ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (New function re...ll: WLDAP32.dll:String) [], RuntimeException
  • FullyQualifiedErrorId : New function reference is null, this is almost certainly a bug in this script. Function: 73. Dll: WLDAP32.dll

i solve this, by removing that "if sentence" from the code...

if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero)
{
Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath"
}

but i doubt it´s the right thing... i´m not a programmer.

thank u guys!!

[gentilkiwi]

In fact, reflective script of @clymb3r does not really deal with ordinal imports... and LDAP functions are imported by ordinal imports.
But because he already made all the hard work, it's easy to fix :)

Around line 1690, replace

[IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName)

by

if($ProcedureName -is [string])
{
    [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName)
}
else
{
    [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddressOrdinal.Invoke($ImportDllHandle, $ProcedureName)
}

Get-RemoteProcAddress might have the problem too, but it does not seem to be used for local or remote powershell (only when the DLL is injected in another process than powershell)

[jun0s]

Thank you very much @gentilkiwi that works. :D

[gentilkiwi]

I'm not certain that this issue must be closed.
This could be the case when one of @clymb3r, @mattifestation or @HarmJ0y will have fixed the Invoke-Mimikatz.ps1 script :)

[jun0s]

lol ....

[HarmJ0y]

@mattifestation is currently fixing the bug and updating Mimikatz to the latest release 👍

[mattifestation]

Updated lib 66c93f9