Pass command on latest version

[dmbada]

I saw on the previous version mortar is able to pass command. So how do you pass command on the latest version?

[zux0x3a]

I think you might referring to the previous release. however, the command still can be passed via process argument when you are doing PE hollowing attack.

all you need is to edit the proc base64 value (

mortar/DLL/agressor.lpr

Line 23 in ac6004a

Proc = 'QzpcV2luZG93c1xzeXN0ZW0zMlxEbGxIb3N0LmV4ZSAvUHJvY2Vzc2lkOns3RUFENUMxMC04QjNGLTExRTYtQUUyMi01NkI2QjY0OTk2MTF9'; //T1036

) to include the process and arguments

so for example if you wanna pass mimikatz options lsadump the proc value should be cmd.exe /c lsadump

hope this helps.