search

trustedsec / unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
https://www.trustedsec.com
Other
3.74k stars 817 forks source link

DNS Fails to generate #98

Closed Metasploiter closed 5 years ago

Metasploiter commented 5 years ago

Hello. i'm trying to use my DNS as hostname for windows/meterpreter/reverse_https payload and but i have this issue as i continue to generate file the backdoor fails to connect with my machine

Issue message:

Happy Magic Unicorns. [!] WARNING. WARNING. Length of the payload is above command line limit length of 8191. Recommend trying to generate again or the line will be cut off. [!] Total Payload Length Size: 8298 Press {return} to continue.

UnknownBean commented 5 years ago

Try going into unicorn.py and turning "AMSI_BYPASS" to "off"

Metasploiter commented 5 years ago

I have turned it off before

trustedsec commented 5 years ago

With AMSI_BYPASS to off, the reverse_https is under the size restriction but its close - try generating a couple of times. I'm working on a packer that shrinks it down and obfuscates to get around AMSI. Should be done soon.

trustedsec commented 5 years ago

Just pushed an update that shrinks the payload down a ton.

Metasploiter commented 5 years ago

Just pushed an update that shrinks the payload down a ton.

It works thank you 👍