Shulou(Shulou.com)06/02 Report--

This article is to share with you about how to bypass AMSI and execute arbitrary Powershell code, the editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

It is well known that AMSI can cause trouble in getting shell.

What is AMSI?

The full name of AMSI is "ANTI MALWARE SCAN INTERFACE", which is the anti-malware scanning interface. As the name suggests, all it has to do is scan, detect and stop anything harmful.

Still don't know what this is? You can check the screenshot below:

Obviously, if you have experience with penetration testing in a Windows environment, you should know that almost all public scripts, including those in Nishang,Empire,PowerSploit, will have such errors.

How does AMSI work?

AMSI previously used a "string-based" detection method to determine whether PowerShell code contained malicious code. See the following figure:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.