itm4n / PrivescCheck

Privilege Escalation Enumeration Script for Windows
BSD 3-Clause "New" or "Revised" License
2.79k stars 416 forks source link

Helper script detected by AMSI when building #37

Closed itm4n closed 1 year ago

itm4n commented 1 year ago

When building the script, the file src\02_Helpers.ps1 is blocked by AMSI.

C:\PATH\TO\PrivescCheck>powershell -ep bypass -c ".\Build.ps1"
[OK] Loaded module file 00_Main.ps1
[OK] Loaded module file 01_Win32.ps1
[KO] Failed to load module file 02_Helpers.ps1
[ERROR] At C:\_WORKSPACE\PrivescCheck\src\02_Helpers.ps1:1 char:1
+ function Test-IsRunningInConsole {
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
[OK] Loaded module file 03_User.ps1
[OK] Loaded module file 04_Services.ps1
[OK] Loaded module file 05_Applications.ps1
[OK] Loaded module file 06_ScheduledTasks.ps1
[OK] Loaded module file 07_Hardening.ps1
[OK] Loaded module file 08_Config.ps1
[OK] Loaded module file 09_Network.ps1
[OK] Loaded module file 10_Updates.ps1
[OK] Loaded module file 11_Credentials.ps1
[OK] Loaded module file 99_Misc.ps1

This can be worked around by disabling "Windows Security" during build, but it would be nice to improve the Builder script in order to bypass detection earlier in the process.

itm4n commented 1 year ago

Slightly modified the Builder script.

  1. Instead of trying to load each script, and then removing the comments, I remove the comments first, and then I try to load the resulting code block.
  2. In addition to the comment blocks, I also remove comment lines. Another benefit is that this reduces the size of the final file even more.

That's it. Apparently, this does the trick because the script is no longer caught by AMSI. :partying_face: