Skip to content
This repository was archived by the owner on Jan 29, 2020. It is now read-only.

Update Invoke-Kerberoast.ps1 - #1358

Open
awsmhacks wants to merge 1 commit into
EmpireProject:devfrom
awsmhacks:patch-2
Open

Update Invoke-Kerberoast.ps1#1358
awsmhacks wants to merge 1 commit into
EmpireProject:devfrom
awsmhacks:patch-2

Conversation

@awsmhacks

Copy link
Copy Markdown
Contributor

Addressing two sections that throw errors. Removing them in dev, these are commented out in master if anyone wants to dig in further but New-DynamicParameter is not a function and I couldn't find it anywhere besides helper scripts on technet.
Looks like it was first introduced in 71c795a

Addressing two sections that throw errors. Removing them in dev, these are commented out in master if anyone wants to dig in further but New-DynamicParameter is not a function and I couldn't find it anywhere besides helper scripts on technet.
Looks like it was first introduced in 71c795a
pull Bot pushed a commit to tigr0w/BC-SECURITY_Empire that referenced this pull request Sep 8, 2026
…1471)

Wire the TrustedSec ldapsearch BOF as a situational_awareness module and
refresh the in-repo object files to the current upstream build. The prior
.o (committed in BC-SECURITY#757) was an older 5-arg build with no scope/LDAPS; the
official x64/x86 objects from TrustedSec's SA/ldapsearch add both.

format_string `zziizzi` (Query, Attributes, ResultCount, Scope, Hostname,
SearchDN, UseLDAPS) verified by disassembling the new .o and cross-checked
against upstream entry.c. Scope is an int (1=base, 2=one level,
3=subtree, constrained strict since out-of-range is undefined); UseLDAPS
toggles 636 vs 389. Runs natively on Go agents (TASK_BOF_CMD_WAIT) and via
the existing RunCOFF harness on C#/PowerShell/IronPython agents.

Closes EmpireProject#1358

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant