HoneyHash Script Injects Incorrect Password into Memory When the Password Contains Characters with Special Significance in Powershell

[zms200]

The script generated by the HoneyHash functionality injects the wrong password into memory when the password provided contains characters considered significant by Powershell, such as a "$"

For example, providing the following input into DejaVu:

Produces the following from mimikatz:

The underlying cause seems to be that the password in the script is enclosed by double-quotes ("P@$$WORD!123"), when it really should be single-quotes ('P@$$WORD!123')

[bhdresh]

Thank you for the report, we are working releasing a new version by end of this week. Will make sure, this is covered there.

Regards,
-Bhadresh

[zms200]

Great! Looking forward to checking out the new version!