Examples of symetric key encryption/decryption with RC4/AES, base64/hex encoding, and Go/PowerShell

The idea being Go generates the payloads on the attack box. The victim downloads the PowerShell payloads and runs them in memory via IEX.

None of the samples here bypass AMSI directly...

For true obfuscated, encrypted, encoded AMSI bypass, look in ./amsi-bypass

Name		Name	Last commit message	Last commit date
amsi-bypass		amsi-bypass
README.MD		README.MD
aes-decrypt.ps1		aes-decrypt.ps1
aes-encrypt.ps1		aes-encrypt.ps1
go-decode-aes-encrypted-base-64.go		go-decode-aes-encrypted-base-64.go
go-encode-ps-aes-encrypted-base64.go		go-encode-ps-aes-encrypted-base64.go
go-encode-ps-rc4-encrypted-hex.go		go-encode-ps-rc4-encrypted-hex.go
ps-decode-invoke-aes-encrypted-base64.ps1		ps-decode-invoke-aes-encrypted-base64.ps1
ps-decode-invoke-rc4-encrypted-hex.ps1		ps-decode-invoke-rc4-encrypted-hex.ps1

Navigation Menu