Skip to content

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 

Repository files navigation

Powershell-Smuggler

Decrypting a powershell script and executing it using scriptblock smuggling, bypassing AMSI and some telemetry.

How it works

Powershell-Smuggler is a compact, tiny powershell script that works by base64 decoding and XOR decrypting an encrypted powershell command or script. After that, it will execute the powershell code using scriptblock smuggling, bypassing AMSI and some powershell logging. Its small size also makes it easy to evade static signature detection.

By default, Powershell-Smuggler will just execute Invoke-Mimikatz, a common command used to test the Windows Defender AMSI provider, you can change it by XOR encrypting and then base64 encoding your powershell payload, and replacing 0xEB,0xC1,0x89,0xB4 and oq//24CkpPmCrODfirXz in Powershell-Smuggler with a key for XOR decryption and your encoded payload.

Examples

Bypassing AMSI for the Invoke-Mimikatz command:

AMSI_bypass

Hiding the real command that will be executed:

Hiding_real_command

More information about the scriptblock smuggling technique can be found here:

https://bcsecurity.io/blog/scriptblock_smuggling/

About

Decrypting a powershell script and executing it using scriptblock smuggling, bypassing AMSI and some telemetry.

Topics

Resources

Stars

2 stars

Watchers

0 watching

Forks

Contributors

Languages