• XSS.stack #1 – первый литературный журнал от юзеров форума

AMSI

Отслеживать
yes possible and works fine on 10,11 but you need to be creative and understand the bypass how it work then write your program , i suggest to use dll to bypass and patch amsi then from the exe load the dll entry point it will bypass amsi then you can load your encrypted malware
 
bg1 сказал(а):
yes possible and works fine on 10,11 but you need to be creative and understand the bypass how it work then write your program , i suggest to use dll to bypass and patch amsi then from the exe load the dll entry point it will bypass amsi then you can load your encrypted malware
Could i write you on DM? And show you my actual work hahaha
 
святой бог сказал(а):
How? It's possible to bypass it from power shell directly? The language which I'm working with it's Java, and the payload it's a powershell bash script
you can also DM me too there are like 7-10 techniques and they all working I can give you free methods on that you can try
 
святой бог сказал(а):
How? It's possible to bypass it from power shell directly? The language which I'm working with it's Java, and the payload it's a powershell bash script
It was in my mind to create a group to develop Red team arsenal
 
святой бог сказал(а):
still workin'¿
No none of those work, they are all outdated. You need to be a little creative when trying to write them. I would recommend writing them in a compiled language then reflective injecting them into powershell or something similar. There are also newer methods that work if you look around on github.
 
If you can call Win32 function from Java using JNI, you can easily bypass AMSI by writting a `ret` in `AmsiScanBuffer()`.

Or better, you can use C# code (since powershell is also a CLR-hosted script interpreter) directly from powershell to patch AmsiScanBuffer.

You can test your paylods using elastic's open-source detection rules (https://github.com/elastic/detection-rules).
 
s0nus сказал(а):
If you can call Win32 function from Java using JNI, you can easily bypass AMSI by writting a `ret` in `AmsiScanBuffer()`.

Or better, you can use C# code (since powershell is also a CLR-hosted script interpreter) directly from powershell to patch AmsiScanBuffer.

You can test your paylods using elastic's open-source detection rules (https://github.com/elastic/detection-rules).
so the steps should be
Write the native function in C/C++ that overrides the behavior of AmsiScanBuffer.

Use JNI in Java to load and call the native function from mine Java application.
 
Последнее редактирование:
admin


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх