Whenever I try to run the White Rabbit script from the RWMC folder in Powershell ISE, it tells me:

The script need an Internet Connection to run
Script terminating...

Even though I have very good connection.
How do I fix this?

I've run 4 times, the first two failed

+++++++++++++++++++++++++++++++++++++++++

[White-Rabbit.ps1] version [0.4] started at 01/26/2016 06:10:24

--- Script terminating ---

Script ended at 01/26/2016 06:10:42

+++++++++++++++++++++++++++++++++++++++++
The 3rd and 4th times do make the lsass.dmp file, and the results are:

[White-Rabbit.ps1] version [0.4] started at 01/26/2016 06:11:24

Login : rrumble
Password :
Login : rrumble
Password :
Login : PC007$
Password :
Login :
Password :
Login : PC007$
Password :
Login : PC007$
Password :
Login : ????????????????????????????????
Password :

Script ended at 01/26/2016 06:11:49

+++++++++++++++++++++++++++++++++++++++++

Another error when I run it against the generated lsass.dmps...

\ /\ Follow the white Rabbit :-)
( ) [email protected]
.( @ ).

RWMC runs with user DOMAIN\rrumble with administrator rights on PC007 computer

Do you want use Active Directory cmdlets ?

1. Yes
2. No
3. Exit

Enter menu number and press : 2
Local computer, Remote computer or from a dump file ?

1. Local
2. Remote
3. lsass process .dmp
4. VM snapshot .dmp
5. Exit

Enter menu number and press : 3
Enter the path of your lsass process dump: C:\Intel\PowerMemory-master\20160126062143
Mode (3 (Windows 2003), 1 (Win 7 and 2008r2), 132 (Win 7 32 bits), 2 (Win 8 and 2012), 2r2 (Win 10 and 2012r2), 232 (Win 10 32 bits) 8.1 (Win 8.1) or 2016 (Windows Server 2016))?: 2r2
Try to reveal password for Windows 10 or 2012r2
Do you want to exfiltrate the data (pastebin) ?

1. Yes
2. No
3. Exit

Enter menu number and press : 2
Do you want to clear event log on this local computer ?

1. Yes
2. No
3. Exit

Enter menu number and press : 2
(see screenshot: http://snag.gy/aeE9A.jpg)

maybe try
http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe****

Ran Get-ActiveDirectoryInfo received data back, but ran into Visio error stating "You are trying to save a file type (Visio 2000-2002 Binary Drawings), Templates and Stencils, which has been blocked by your File Block settings in the Trust Center."

I unchecked every box in Visio File Block settings, tested with Microsoft Active Directory Topology Diagrammer to see if the stencils would load and draw in Visio, which they only did in MS ADTD. For some reason, I am still receiving this error when running the Get-ActiveDirectoryInfo script.

Just checking to see if anyone has run into this before.

no found in Empire
can u tell me what is name the moudle

Script not working, just spams a bunch of links in the powershell window. Doesn't actually crash on Windows 8 and Windows 10. I haven't tried it on Windows 7 though.

Hi,

I generated a dump of memory from a VM running on an ESXi.
The script runs but the output is:
Login : ?????...?.????.?┴.??.???????????

Wonder if I am doing something wrong and you experienced similar results in the past.

Thanks.

I started powershell with admin privilege,

. .\PowerMemory.ps1

Then select option 1

It looks like a CMD window started and closed, no output

Any ideas?

Windows 7 32 bit does not seem to be supported. It maps to mode 132, which is considered a "supported OS" by the script. Then it calls Get-SupportedSystemsInformations, which only initially sets the $start variable for modes 1, 2, 8.1, "2r2", "2016", and "232". This leads to a bunch of errors related to the variables not being set, and the passwords are not retrieved (the usernames are, though).

The variable '$start' cannot be retrieved because it has not been set.
At C:\users\myuser\Desktop\PowerMemory-master\RWMC\supportedOS\Get-InformationsFromSupportedOS.ps1:29 char:22

•         $value = $start
  

•                  ~~~~~~
  

  • CategoryInfo : InvalidOperation: (start:String) [], RuntimeException
  • FullyQualifiedErrorId : VariableIsUndefined