ghostpack/safetykatz

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

safetykatz's Issues

How to get mimkatz as string

The unpack string to byte array method, is inside the code how to reverse this?
Means, Give a function an executable byte array and then take the packet string?

Suggestion:Implement a way to return the output and prevent termination of parent

When executed in memory using .Net reflection using a similar technique
as this : https://jimshaver.net/2018/07/25/safetykatz-over-net/#more-661 I encountered the following issue:

1. I can't seem to find a way to get the output from the calling program (btw it's the same issue for other GhostPack tools).
2. Once Safetykatz has finished its execution it also terminates the parent process (probably due to the usage of the PELoading technique)

Does it make sense ? Any idea ?

Detected by Windows security

Any way to be undetectable by windows security?

how to upgrade build in Mimikatz to latest version ?

build in version is mimikatz 2.1.1 and latest version is 2.2.0
please

Suggestion: move mimikatz compiled blob in a second file

The mimikatz compiled blob in the compressedString variable makes Visual Studio slow and laggy when scrolling the code or debugging in step-by-step.
To prevent this, I suggest moving this blob to a second file (e.g. Constants.cs)