https://github.com/uixss/amsi-bypass-powershell

AMSI Bypass - Credits @ZeroMemoryEx
https://github.com/uixss/amsi-bypass-powershell

Last synced: 2 months ago
JSON representation

AMSI Bypass - Credits @ZeroMemoryEx

• Host: GitHub
• URL: https://github.com/uixss/amsi-bypass-powershell
• Owner: uixss
• License: unlicense
• Created: 2024-10-02T01:04:10.000Z (4 months ago)
• Default Branch: main
• Last Pushed: 2024-10-02T03:31:51.000Z (4 months ago)
• Last Synced: 2024-10-19T04:33:44.651Z (3 months ago)
• Language: Python
• Homepage:
• Size: 75.2 KB
• Stars: 2
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# AMSI Bypass

Monitor processes in the system and check if amsi.dllis loaded in the process powershell.exe. If it is detected that amsi.dllIt's loaded, call the second script (amsi.py) to apply the patch.

Main functions:

### Note:

The use of these scripts is intended for educational purposes and security research. Misuse in environments without proper authorization may violate laws or regulations.

# Credits

https://github.com/ZeroMemoryEx

https://github.com/S1lkys/SharpKiller

 | 48:85D2 | test rdx, rdx |

 | 74 3F | je amsi.7FFAE957C694 |

 | 48 : 85C9 | test rcx, rcx |

 | 74 3A | je amsi.7FFAE957C694 |

 | 48 : 8379 08 00 | cmp qword ptr ds : [rcx + 8] , 0 |

 | 74 33 | je amsi.7FFAE957C694 |

- the search pattern will be like this :

{ 0x48,'?','?', 0x74,'?',0x48,'?' ,'?' ,0x74,'?' ,0x48,'?' ,'?' ,'?' ,'?',0x74,0x33}

![image](https://github.com/ltcflip/amsi-bypass/assets/153377701/3a57f643-2896-49b1-b96f-80e1e7f56852)

# Patch

![image](https://github.com/ltcflip/amsi-bypass/assets/153377701/339ad662-591e-48cd-bab0-adf475d4d1dc)

## Contributing

Feel free to submit issues or pull requests to improve the functionality and error handling in these scripts.