So as we've seen in this course,
PowerShell is a really awesome tool that you can use for penetration testing.
There is a suite of different tools that exist that work
with PowerShell so that you can conduct different types
of offensive security tasks.
Now, as you make use of the PowerShell scripts,
you need to obfuscate those scripts, and of course,
as detection mechanisms get more advanced,
you need to make sure that you try to evade them as much as possible.
A great framework that you can use is Invoke‑Obfuscation.
Invoke‑Obfuscation can be downloaded from GitHub using the link on your screen.
To import that into PowerShell is pretty simple.
You need to use the command, Import‑Module,
followed by the module that you're going to be importing.
Once the module has been imported, to start the framework,
all you need to do is issue Invoke‑Obfuscation.
This will now go ahead and start the framework.
This framework is really cool; the reason being is that you
can actually issue the TUTORIAL command,
and it will tell you exactly how to use the framework.
When you take a look at the options,
you see that there are a number of different options
that you can use within this framework.
But before we start with the options,
we first need to define the script that we want to obfuscate.
I'm going to make use of a script that we've used previously,
and this is the one that points to PowerView and
issues the Get‑NetDomain function.
So I'm going to define this by using the set scriptblock command,
and now I can make use of the options.
And the option that I'm going to work with is the string option.
All I need to do is enter the text string,
and now I get the various sub options of that main option.
So here the framework gives me three options.
I can concatenate the entire command, reorder it, or even reverse it.
So let's take a look at what reverse does.
I'll issue the number 3 because that's the third option that I
want to choose and immediately I get my result.
So now, I can actually just copy this result as it is and run it on PowerShell.
So let's try this out.
I'll copy this result, and I've switched now to my attacker machine,
and I'm going to go ahead and paste the script in.
Now, as you can see,
the script output is exactly the same as what Invoke‑Obfuscation has given me,
so let's see what the output is.
As I hit Enter, I get the results from PowerView.
Now,
what's great is that this script could probably
evade detection to a certain degree,
but what if we wanted to make it a bit more obscure?
So I'm going to switch back to Kali Linux,
and this time I'll go back, and I'm going to select encoding.
Now under encoding, I've got eight different options that I could use.
I like the one that talks about a secure string,
making use of AES, so I'm going to go ahead and select that one.
As I hit Enter, I get quite a large output of my obfuscated PowerShell command.
So again, let's give this a try, and as I hit Enter, I get my results.
So now let's see if our obfuscated command can bypass detection.
I'm going to start with my standard download cradle,
and this is the straightforward cradle that's using the
WebClient with the DownloadString, and again,
looking at my PowerView module.
As I hit Enter, I get a message that it's blocked by my antivirus software.
Now, let's go ahead and try the obfuscated command.
I'll use the one that I've just created,
and as I hit Enter, I get my results,
and just to confirm that my antivirus is turned on.
Now at the time of recording this demo, this worked.
You might get a different output, but again,
you can work with the Invoke‑Obfuscation framework to go and create
different types of obfuscated scripts that you can use.
Let's switch back to Kali Linux and look at some
additional options on Invoke‑Obfuscation.
Now, one thing that I would like to mention,
when you make use of Invoke‑Obfuscation,
keep in mind that as you work with the different obfuscation options,
it will actually go and append to your script.
So if you take a look at the script that we've just
created using the encoding option, you can see it's pretty large.
The reason for this is because it's actually taken our first string
option that we've used of reversing the command,
and then it's gone and encoded that reversed command.
So let me illustrate.
I'll issue the reset command,
which is going to reset all of the obfuscations that we've done.
I'll then redo the encoding option, and again select option number 5,
and now, you'll see that my script length is a lot less.
So keep that in mind because you might run into a limit when it comes to
the amount of characters that PowerShell can accept.