Invoke-MimikatzWDigestDowngrade.ps1 is unable to lock a machine #29
Assignees
Labels
Comments
|
As suggested by Peter, tsdiscon.exe is able to lock the machine. Also, the machine unlock event which starts Invoke-Mimikatz in the script is not getting triggered in case of RDP connections. Testing different approaches. For example, tried Win32_ProcessStopTrace and Win32_ProcessStartTrace for TSTheme process, but no success, yet. |
|
Unable to figure out a WMI event that is triggered when a RDP session becomes active. Also, tsdiscon is not logging off a user, so WDigest downgrade doesn't work as well. |
samratashok
added a commit
that referenced
this issue
Jan 1, 2016
|
Turns out that the script worked fine for console logins (and is good for client side attacks as well). The support for RDP sessions has been added. |
This issue was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
A user, Peter, reported over email that Invoke-MimikatzWDigestDowngrade.ps1 is unable to lock a target machine. I was able to reproduce the bug. The user also suggested an improvement. I am currently testing it.
The text was updated successfully, but these errors were encountered: