• XSS.stack #1 – первый литературный журнал от юзеров форума

Powershell obfuscation

katg

RAID-массив
Пользователь
Регистрация
20.12.2020
Сообщения
69
Реакции
9
Гарант сделки
1
Hey all, Could someone shed light on how to obfuscate a PowerShell script, im trying to send it as a macro in a word document.
My plan is to run it in memory so i need to bypass AMSI as well as defender for windows. thank you and sorry for my terrible english
 
Пожалуйста, обратите внимание, что пользователь заблокирован
Hey all, Could someone shed light on how to obfuscate a PowerShell script, im trying to send it as a macro in a word document.
My plan is to run it in memory so i need to bypass AMSI as well as defender for windows. thank you and sorry for my terrible english
Write me in PM or TOX.

A5852A300E402AD8AA973E1147D024FFE7DCF34BCC203C7B9DFB8560A3B10361000000000003
 
Пожалуйста, обратите внимание, что пользователь заблокирован
Hey all, Could someone shed light on how to obfuscate a PowerShell script, im trying to send it as a macro in a word document.
My plan is to run it in memory so i need to bypass AMSI as well as defender for windows. thank you and sorry for my terrible english
did you try free tool to obfuscate and they don't work ?
 
did you try free tool to obfuscate and they don't work ?
i tried invoke-obfuscation, it worked on my VM environment but when I tested in a lab i created it did not call back to my c2 but at the same time it did not alert windows av, its really confusing,, if you have any recommendations for tools let me know please.
 
Why not send as base64?
i need to patch the target machine with rastamouse for base64 no? i read about it a little but i felt like its double the work, if im trying to compromise a network how many macros will they run,,, if you know any better i love to learn thanks
 
Пожалуйста, обратите внимание, что пользователь заблокирован
using tools from github didn't help you with that ?
i tried invoke-obfuscation but its dead, it was strange because the av didnt signal malicious behavior but it doesnt connect to the c2, but when i turned of the av and pasted the c2 raw pws script it connected. obfuscation is headache and expensive some guy wants 5k to fud lol
 
Hey all, Could someone shed light on how to obfuscate a PowerShell script, im trying to send it as a macro in a word document.
My plan is to run it in memory so i need to bypass AMSI as well as defender for windows. thank you and sorry for my terrible english
you can do this in multiple stages, convert your raw payload into base64 replace some chars with other stuff to make base64 more ugly then write a function to reverse this all and execute it, and put this in file and just tell powershell to read from server and pipe to iex (execute) https://xss.pro/threads/68680/ this will help you :) , you can do lot of stuff with powershell just need to be more creative :)
 


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх