Amsi Evasion

Agent.ps1

Amsi Evasion

So we are looking for pwsh not powershell, lol

which pwsh?
/usr/bin/pwsh

exelent ...

which pwsh?
/usr/bin/pwsh

i need to know if venom user was powershell installed before running meterpeter.ps1 .. <--- checking the existence of this folder works fine..
and i need to know if attacker its x64 bits arch (M$ does not give PS to x32 bits) .. <--- already done ..

Sweet✅💯🔥

TASK

• Record 'meterpeter' [Window vs Windows] oficial release video ..
  
  

Task Description

hey @codings9 i need your help again ...

To record a video tutorial about 'meterpeter' windows VS Windows  ...
using the 'new terminal windows' configurated to run meterpeter tool ..

New Windows Terminal (M$)

---

Step-By-Step

• 1º - Download new meterpeter project (oficial release)

git clone https://github.com/r00t-3xp10it/meterpeter.git

• 2º - Install new windows terminal
  Install new windows terminal (Under Windows Distros)
  

• 3º - download/install new microsoft font (Cascadia.ttf)
  Microsoft Cascadia code Font
  

• 4º - Add meterpeter tool to the new terminal TAB list

Remenber to change the PATHs to point to your Local meterpeter installation

1º - Create a new GUID for meterpeter tool
     To Creat new GUID visit: http://new-guid.com/

2º - press <'settings'> button in 'new terminal' and copy paste the follow code under
     "profiles":  -> "list":

            },  // <-- REMMENBER TO ADD , IN PREVIOUS CLOSE BRACKLETS FUNCTION ...
                // BEFORE ADDING A NEW FUNCTION TO YOUR PROFILE.JSON FILE

            {
                // Make changes here to the meterpeter profile
                "guid": "{1972e6a7-daef-4cfc-8180-3eecfef9630d}",
                "name": "meterpeter C2",
                "fontFace": "Cascadia Code",
                "backgroundImageStretchMode" : "uniformToFill",
                "backgroundImage" : "%USERPROFILE%\\Desktop\\meterpeter\\mimiRatz\\darkside.gif",  // <-- Terminal animated background gif Path
                "commandline": "powershell.exe -ExecutionPolicy Bypass -NoLogo -NoExit -File \"%USERPROFILE%\\Desktop\\meterpeter\\meterpeter.ps1\"",    // <-- meterpeter.ps1 script Path
                "startingDirectory" : "%USERPROFILE%\\Desktop\\meterpeter",               // <-- meterpeter folder Path
                "icon" : "%USERPROFILE%\\Desktop\\meterpeter\\mimiRatz\\Alien-icon.png",  // <-- Terminal tab icon Path
                "hidden": false
            }

[i] my profile.json file (Configuration example)

[i] meterpeter WIKI pages

Doing the video, just be aware that ps1 file was not downloaded via the bat- i manually moved it to disk and ran it. And Windows picks up the file soon as it touches disk, sample submission off. I had to allow it for the video-I think i understand why Microsoft bought github...now...they have access to all of this...code....Don’t worry will not show on video.

The Terminal is amazing love the integration with MeterPeter✅💯🔥

https://youtu.be/k9aX3yBQrEQ

hey thanks ..ive just arrived home ..

Lol, no worries anytime...✅💯🔥, thank you!

👍