Detailed Explanation of Status codes for HTTP responses
What HTTP Response Status Codes Are And Why They Are ImportantContinue reading on Bug Zero »
Read more...
What HTTP Response Status Codes Are And Why They Are ImportantContinue reading on Bug Zero »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
https://blogger.googleusercontent.com/img/a/AVvXsEhvHxpOWiJ1NSyXmIWJcHIH7haCoxHylKQQ9-j13MtsLdnMdFOU3Mzs_QT7x-7RH3us_9j08DEzdwUUYAPpQnJXC_nUaLHCR2LExWqmgwds-IjoRT4nQX-xhj8cAaFUbvlzvaxpYW509hY4DMGpm0kUk_I1wN8WgTaW6V-Q-mPKVPdUK6tCiLavJcby_w=w640-h338 Traditional obfuscation techniques tend to add layers to encapsulate standing code, such as base64 or compression. These payloads do continue to have a varied degree of success, but they have become trivial to extract the intended payload and some launchers get detected often, which essentially introduces chokepoints.
The approach this tool introduces is a methodology where you can target and obfuscate the individual components of a script with randomized variations while achieving the same intended logic, without encapsulating the entire payload within a single layer. Due to the complexity of the obfuscation logic, the resulting payloads will be very difficult to signature and will slip past heuristic engines that are not programmed to emulate the inherited logic.
While this script can obfuscate most payloads successfully on it's own, this project will also serve as a standing framework that I will to use to produce future functions that will utilize this framework to provide dedicated obfuscated payloads, such as one that only produces reverse shells.
I wrote a blog piece for Offensive Security as a precursor into the techniques this tool introduces. Before venturing further, consider giving it a read first: https://www.offensive-security.com/offsec/powershell-obfuscation/ Dedicated PayloadsAs part of my on going work with PowerShell obfuscation, I am building out scripts that produce dedicated payloads that utilize this framework. These have helped to save me time and hope you find them useful as well. You can find them within their own folders at the root of this repository.
1. Get-ReverseShell
2. Get-DownloadCradle
3. Get-Shellcode ComponentsLike many other programming languages, PowerShell can be broken down into many different components that make up the executable logic. This allows us to defeat signature-based detections with relative ease by changing how we represent individual components within a payload to a form an obscure or unintelligible derivative.
Keep in mind that targeting every component in complex payloads is very instrusive. This tool is built so that you can target the components you want to obfuscate in a controlled manner. I have found that a lot of signatures can be defeated simply by targeting cmdlets, variables and any comments. When using this against complex payloads, such as print nightmare, keep in mind that custom function parameters / variables will also be changed. Always be sure to properly test any resulting payloads and ensure you are aware of any modified named paramters.
Component types such as pipes and pipeline variables are introduced here to help make your payload more obscure and harder to decode.
Supported Types
* Aliases (iex)
* Cmdlets (New-Object)
* Comments (# and <#)
* Integers (4444)
* Methods ($client.GetStream())
* Namespace Classes (System.Net.Sockets.TCPClient)
* Pipes (|)
* Pipeline Variables ($_)
* Strings ("value" | 'value')
* Variables ($client) GeneratorsEach component has its own dedicated generator that contains a list of possible static or dynamically generated values that are randomly selected during each execution. If there are multiple instances of a component, then it will iterative each of them individually with a generator. This adds a degree of randomness each time you run this tool against a given payload so each iteration will be different. The only exception to this is variable names.
If an algorithm related to a specific comp[...]
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
https://blogger.googleusercontent.com/img/a/AVvXsEhvHxpOWiJ1NSyXmIWJcHIH7haCoxHylKQQ9-j13MtsLdnMdFOU3Mzs_QT7x-7RH3us_9j08DEzdwUUYAPpQnJXC_nUaLHCR2LExWqmgwds-IjoRT4nQX-xhj8cAaFUbvlzvaxpYW509hY4DMGpm0kUk_I1wN8WgTaW6V-Q-mPKVPdUK6tCiLavJcby_w=w640-h338 Traditional obfuscation techniques tend to add layers to encapsulate standing code, such as base64 or compression. These payloads do continue to have a varied degree of success, but they have become trivial to extract the intended payload and some launchers get detected often, which essentially introduces chokepoints.
The approach this tool introduces is a methodology where you can target and obfuscate the individual components of a script with randomized variations while achieving the same intended logic, without encapsulating the entire payload within a single layer. Due to the complexity of the obfuscation logic, the resulting payloads will be very difficult to signature and will slip past heuristic engines that are not programmed to emulate the inherited logic.
While this script can obfuscate most payloads successfully on it's own, this project will also serve as a standing framework that I will to use to produce future functions that will utilize this framework to provide dedicated obfuscated payloads, such as one that only produces reverse shells.
I wrote a blog piece for Offensive Security as a precursor into the techniques this tool introduces. Before venturing further, consider giving it a read first: https://www.offensive-security.com/offsec/powershell-obfuscation/ Dedicated PayloadsAs part of my on going work with PowerShell obfuscation, I am building out scripts that produce dedicated payloads that utilize this framework. These have helped to save me time and hope you find them useful as well. You can find them within their own folders at the root of this repository.
1. Get-ReverseShell
2. Get-DownloadCradle
3. Get-Shellcode ComponentsLike many other programming languages, PowerShell can be broken down into many different components that make up the executable logic. This allows us to defeat signature-based detections with relative ease by changing how we represent individual components within a payload to a form an obscure or unintelligible derivative.
Keep in mind that targeting every component in complex payloads is very instrusive. This tool is built so that you can target the components you want to obfuscate in a controlled manner. I have found that a lot of signatures can be defeated simply by targeting cmdlets, variables and any comments. When using this against complex payloads, such as print nightmare, keep in mind that custom function parameters / variables will also be changed. Always be sure to properly test any resulting payloads and ensure you are aware of any modified named paramters.
Component types such as pipes and pipeline variables are introduced here to help make your payload more obscure and harder to decode.
Supported Types
* Aliases (iex)
* Cmdlets (New-Object)
* Comments (# and <#)
* Integers (4444)
* Methods ($client.GetStream())
* Namespace Classes (System.Net.Sockets.TCPClient)
* Pipes (|)
* Pipeline Variables ($_)
* Strings ("value" | 'value')
* Variables ($client) GeneratorsEach component has its own dedicated generator that contains a list of possible static or dynamically generated values that are randomly selected during each execution. If there are multiple instances of a component, then it will iterative each of them individually with a generator. This adds a degree of randomness each time you run this tool against a given payload so each iteration will be different. The only exception to this is variable names.
If an algorithm related to a specific comp[...]
KitPloit - PenTest Tools!
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
KitPloit - PenTest & Hacking Tools
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Rise of Automotive Hacking
https://cdn-images-1.medium.com/max/960/1*uuw-xF-dcScMZjegY90RUg.jpeg
With the increasing use of technology in modern automobiles, the risk of automotive hacking is on the rise. Automotive hacking refers to…
Continue reading on Medium »
Rise of Automotive Hacking
https://cdn-images-1.medium.com/max/960/1*uuw-xF-dcScMZjegY90RUg.jpeg
With the increasing use of technology in modern automobiles, the risk of automotive hacking is on the rise. Automotive hacking refers to…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Lesson 1A: Setting Up Your Malware Development Environment with Visual Studio and .NET Framework
https://cdn-images-1.medium.com/max/1917/1*xL1LRyW1oV04xnfeU2ELMg.png
👾 Malware Development Series by XIT (C#)
Continue reading on Medium »
Lesson 1A: Setting Up Your Malware Development Environment with Visual Studio and .NET Framework
https://cdn-images-1.medium.com/max/1917/1*xL1LRyW1oV04xnfeU2ELMg.png
👾 Malware Development Series by XIT (C#)
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
SPAM detection using NLP - python & machine Learning
https://cdn-images-1.medium.com/max/800/1*VwlHjFioPhbvh_zw3i8xwQ.jpeg
Build tool for spam detection using tensorflow keras, sklearn and nltk.
Continue reading on Medium »
SPAM detection using NLP - python & machine Learning
https://cdn-images-1.medium.com/max/800/1*VwlHjFioPhbvh_zw3i8xwQ.jpeg
Build tool for spam detection using tensorflow keras, sklearn and nltk.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
# Internet Security Brief **Listen up, internet users!
**2. Use strong and unique passwords:** Create complex passwords for all your devices and accounts, using a mix of upper- and lowercase…
Continue reading on Medium »
# Internet Security Brief **Listen up, internet users!
**2. Use strong and unique passwords:** Create complex passwords for all your devices and accounts, using a mix of upper- and lowercase…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Shattered Tablet (by HackTheBox CYBER APOCALYPSE) | category — reverse engineering
https://cdn-images-1.medium.com/max/1920/1*Qm2JIdqlBah6uv-ibsaUQQ.png
Hey everyone, This is whoamiPwns and I hope you all are doing good. This time we are going to analyze an ELF (Executable and Link-able…
Continue reading on Medium »
Shattered Tablet (by HackTheBox CYBER APOCALYPSE) | category — reverse engineering
https://cdn-images-1.medium.com/max/1920/1*Qm2JIdqlBah6uv-ibsaUQQ.png
Hey everyone, This is whoamiPwns and I hope you all are doing good. This time we are going to analyze an ELF (Executable and Link-able…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
DAY -2 ETERNAL BLUE
https://cdn-images-1.medium.com/max/1920/1*gKopi3mkAalQ7XlxCqWdcA.png
ALL THE FLAG ANSWERS ARE AT THE END (SCRIPT KIDDO)
Continue reading on Medium »
DAY -2 ETERNAL BLUE
https://cdn-images-1.medium.com/max/1920/1*gKopi3mkAalQ7XlxCqWdcA.png
ALL THE FLAG ANSWERS ARE AT THE END (SCRIPT KIDDO)
Continue reading on Medium »