D3Ext D3Ext

AMSI Bypass

To perform all this techniques you can simply try them by typing "Invoke-Mimikatz" into your powershell terminal, you'll notice that even if you haven't imported Mimikatz it will detect that as malicious. But if the AMSI is off or you avoid it, it just will say that "it's not recognized as the name of a cmdlet", so you could say that you've bypassed the AMSI

However some methods may be detected by the AV but most of them actually work without problem

Powershell downgrade

The first and worst way to bypass AMSI is downgrading powershell version to 2.0.

Introduction

This guide aids with the ArchLinux installation using VMWare

This is based on the official Arch Linux installation guide, my own experience and some videos I found on Youtube.

Installation

First of all change the keyboard layout to the desired language with loadkeys, in my case to spanish

	#[

	Author: Marcello Salvati, Twitter: @byt3bl33d3r
	License: BSD 3-Clause

	AES256-CTR Encryption/Decryption
	]#

	import nimcrypto
	import nimcrypto/sysrand

	#!/usr/bin/env python3

	from scapy.all import *

	def PacketHandler(pkt):
	if pkt.haslayer(Dot11) and pkt.type == 0 and pkt.subtype == 0xC:
	print("Deauth packet sniffed: %s" % (pkt.summary()))

	sniff(iface="wlan0mon", prn = PacketHandler)

	package main

	import (
	"fmt"
	"os"
	"strings"
	"bytes"
	"strconv"
	"flag"
	)

	#!/usr/bin/env python3
	#
	# Script for automatic upload of handshakes captured
	# by Pwnagotchi, Flipper Zero or Marauder to
	# Distributed WPA PSK auditor (wpa-sec.stanev.org).
	#
	# The script is progressive, not sending to WPA Sec
	# handshaske already analysed.
	#
	# The script also saves the detected WPA keys locally.