{"id":13839858,"url":"https://github.com/Flangvik/BetterSafetyKatz","last_synced_at":"2025-07-11T07:31:11.061Z","repository":{"id":53481376,"uuid":"262289959","full_name":"Flangvik/BetterSafetyKatz","owner":"Flangvik","description":"Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.","archived":false,"fork":false,"pushed_at":"2021-03-29T13:15:58.000Z","size":1521,"stargazers_count":835,"open_issues_count":0,"forks_count":116,"subscribers_count":16,"default_branch":"master","last_synced_at":"2024-11-15T02:00:54.429Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Flangvik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-08T10:07:25.000Z","updated_at":"2024-11-15T01:14:14.000Z","dependencies_parsed_at":"2022-08-16T07:50:13.406Z","dependency_job_id":null,"html_url":"https://github.com/Flangvik/BetterSafetyKatz","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FBetterSafetyKatz","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FBetterSafetyKatz/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FBetterSafetyKatz/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FBetterSafetyKatz/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Flangvik","download_url":"https://codeload.github.com/Flangvik/BetterSafetyKatz/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225705030,"owners_count":17511210,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:00:36.658Z","updated_at":"2024-11-21T09:30:30.890Z","avatar_url":"https://github.com/Flangvik.png","language":"C#","funding_links":[],"categories":["C# #","C# (212)"],"sub_categories":[],"readme":"# BetterSafetyKatz?\n\nThis modified fork of SafetyKatz dynamically fetches the latest pre-compiled release of Mimikatz directly from the gentilkiwi GitHub repo, \nruntime patching on detected signatures and uses SharpSploit DInvoke to get it into memory.\n\n1. Gets the URL for the latest ZIP / PreCompiled Mimikatz binary directly from GitHub Repo\n2. Unzipped in memory, turned into HEX. Then strings/signatures detected by Windows Defender are replaced with random strings of the same size \n    (Used https://github.com/matterpreter/DefenderCheck to gather signatures detected)\n3. PE-Loaded into mem using SharpSploit 1.6 DInvoke, bypassing API hooking.(https://thewover.github.io/Dynamic-Invoke/)\n\nStolen from @harmj0y, @TheRealWover, @cobbr_io and @gentilkiwi, repurposed by @Flangvik and @Mrtn9\n\n[@harmj0y](https://twitter.com/harmj0y) is the primary author of the port that this repo is forked from.\n\nBetterSafetyKatz is licensed under the BSD 3-Clause license.\n\n## Detected?\n\nBetterSafetyKatz has basic signature detections by now, some obfuscation will do the trick! \n\n\tPS D:\\Projects\\NetLoader\u003e .\\BetterSafetyKatz.exe \n\t[+] Stolen from @harmj0y, @TheRealWover, @cobbr_io and @gentilkiwi, repurposed by @Flangvik and @Mrtn9\n\t[+] Contacting repo -\u003e 2.2.0-20200519/mimikatz_trunk.zip\n\t[+] Randomizing strings in memory\n\t[+] Suicide burn before CreateThread!\n\n\t  .#####.   022PO6WM 2.2.0 (x64) #19041 May 19 2020 00:48:59\n\t .## ^ ##.  \"2HREDZLQ6LC4KWE48WS\" - (J888K)\n\t ## / \\ ##  /*** SX6HATY8UCZTFP `3I6B0MYQ03` ( 66OC8VHW@3I6B0MYQ03.com )\n\t ## \\ / ##       \u003e http://blog.3I6B0MYQ03.com/022PO6WM\n\t '## v ##'       KVY3O5BG9LH90CH             ( EWGZ4I5Z22719E0QZJTNFIJF )\n\t  '#####'        \u003e VOIN6NBQ5J7P55TZBTT4H / WXFFZUHZ5JPERL93VZ3VC1W   ***/\n\n\t022PO6WM # coffee\n\n\t\t( (\n\t\t ) )\n\t  .______.\n\t  |      |]\n\t  \\      /\n\t   `----'\n\n\t022PO6WM #\n\t\nYou can also specify a remote OR local path to unzip yourself (Not contacting the master GitHub repo)\n\n\tPS D:\\Tools\\Katz\u003e .\\BetterSafetyKatz.exe '.\\mimikatz_trunk.zip'                                         \n\t[+] Stolen from @harmj0y, @TheRealWover, @cobbr_io and @gentilkiwi, repurposed by @Flangvik and @Mrtn9\n\t[+] Fetching .\\mimikatz_trunk.zip\n\t[+] Randomizing strings in memory\n\t[+] Suicide burn before CreateThread!\n\n\t  .#####.   83RMVZA8 2.2.0 (x64) #19041 Jul 15 2020 16:10:52\n\t .## ^ ##.  \"FPN5DDHQGD5GF7M775W\" - (AX8RH)\n\t ## / \\ ##  /*** 1HVUZ68IQYGG3I `EWE37C7HUD` ( R9ECUOAN@EWE37C7HUD.com )\n\t ## \\ / ##       \u003e http://blog.EWE37C7HUD.com/83RMVZA8\n\t '## v ##'       TTCPO5BUID45UFP             ( FD1XGKSOLS8XHA8DEW9X8VO9 )\n\t  '#####'        \u003e K8IYUY2XSLBG3S3VXV8ZN / POCIYP0U92KNJYG463LVDYJ   ***/\n\n\t83RMVZA8\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FFlangvik%2FBetterSafetyKatz","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FFlangvik%2FBetterSafetyKatz","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FFlangvik%2FBetterSafetyKatz/lists"}