[MUSIC PLAYING]
Obfuscating PowerShell code.
In this video, we are going to be exploring the process of how
to obfuscate PowerShell code in order to essentially evade
or avoid antivirus detection.
So let's get an idea of what obfuscation is firstly.
So obfuscation refers to the process
of concealing something important, valuable,
or critical.
And in the context of exploitation,
obfuscation can be used to reorganize code
or in this case PowerShell code in order
to make it harder to analyze or reverse engineer.
And in the context of an antivirus solution,
obfuscation will make it harder to flag
or rather harder to analyze as and obviously categorize
as either malicious or not.
So as a penetration tester, you'll
find yourself working with PowerShell code frequently.
Most antivirus solutions will immediately
flag PowerShell code that hasn't been encoded or obfuscated
for obvious reasons.
And as a result, you must be able to obfuscate or encode
your PowerShell code and scripts in order to avoid detection.
So in regards to obfuscating PowerShell code,
we are going to be taking advantage
of a fantastic tool or utility called Invoke-Obfuscation.
Invoke-Obfuscation is an open source PowerShell version
2 and higher, compatible PowerShell command
and script obfuscator.
So the way it works is that it essentially
allows us to load up or to load in our PowerShell script
that we want to execute on the target.
It then provides us with various options
that we can use to obfuscate or encode the code.
And then generates the output, which we can then
save into a new PowerShell script,
and that PowerShell script is fully obfuscated or encoded,
and we can then transfer that to the target
system for execution.
Or alternatively, that code can be included
as part of a larger exploit.
So the GitHub repository for Invoke-Obfuscation
is listed or linked to this particular slide.
Now, this video doesn't have a lab environment
for obvious reasons.
And again, I'm just going to be performing
this within my lab environment.
In this case, the target system is
going to be a specific build of Windows 10,
where I do know that this technique does work.
The purpose of this video is to just demonstrate
the process of obfuscating PowerShell code,
and how it can be done, and the fact
that it does actually work in regards
to obtaining a reverse shell.
So I'll just switch over to my Kali Linux VM
and we can get started.
All right, so I'm back within my Kali Linux VM,
and I'm currently on the Invoke-Obfuscation GitHub
repository.
And you can see that it has a list of PowerShell scripts
here, as well as a specific Invoke-Obfuscation PowerShell
module that we can import.
And you can go through the GitHub repository
to learn more about it.
And you can take a look at the purpose
here, which is very really is fantastic
as to why this tool was created.
So it really is a very, very powerful tool.
And again, it automates that entire process of obfuscation.
All right, so in regards to using it,
there are a few dependencies that we need to install.
Now you might have noticed that it has PowerShell scripts
and modules.
So how do we execute or load or import a PowerShell module
on Linux?
Because we currently don't have access
to PowerShell on a Linux system.
Well, here's the great thing.
We actually can run PowerShell on Linux,
and that can be done by installing
the PowerShell package, which is part of the Kali Linux
repositories.
So that will allow us to import the Invoke-Obfuscation
PowerShell module here.
And consequently, allow us to load up
Invoke-Obfuscation, which we can then use to essentially pass
in our reverse shell code, which is,
of course, going to be in PowerShell.
So just clone the repository into any folder
you want on your desktop wherever you feel
is comfortable for you.
In my case, I have cloned it into my AVBypass folder
that I created in the previous video.
And you can see I have it right over here, Invoke-Obfuscation.
Now, we also need to take a look at the reversal code
that we'll be using.
So during the bind and reversal section of this course,
I went over the reversal cheat sheet,
and I referenced the actual payload all the things
GitHub repository.
And I'm currently within the PowerShell reversal section.
So we will be utilizing the following code here.
So this is just a basic reversal written in PowerShell.
And the only variables that we need to modify
is the attacker's IP here, as well as
the port that we will be listening on with Netcat.
So just keep that in mind.
Now, the first dependency that we need to install
is going to be PowerShell.
So this can be installed on Linux
by saying sudo apt-get install.
And I'll say apt-get install.
And we can say powershell.
There we are.
And I'll say yes.
And I'll just provide my password here.
We also have the latest version.
So how do you launch PowerShell on Linux?
Well, we just type in pwsh, so powershell, hit Enter.
And voila, we have access to a PowerShell session on Linux.
All right, so that means we can essentially
execute PowerShell scripts and import
modules that we can then use.
So I'm currently within the AVBypass folder.
I want to navigate into the cloned Invoke-Obfuscation
directory.
Within this directory, you can see
that I have all the various PowerShell scripts.
What I'm interested in is the Invoke-Obfuscation PowerShell
module.
So we can import it by saying import,
and this is a PowerShell command.
So we can say import module.
And then we specify the name of the module.
In this case, it's Invoke-Obfuscation.psd1.
So I'll hit Enter.
That is imported.
I can then take a step back or get out
of the Invoke-Obfuscation directory,
and I can say Invoke-Obfuscation.
Let me just type that incorrectly.
So Invoke-Obfuscation.
And I just want to run the command, not the actual--
I don't get into the directory.
So I'll just say Invoke-Obfuscation.
And if successful, it should bring up Invoke-Obfuscation
now.
So give that a couple of seconds.
As you can see, it's loading up.
And there we are.
So Invoke-Obfuscation.
Welcome.
So this is a fantastic tool for essentially obfuscating
and encoding PowerShell code.
So it gives you a great list of commands
in regards to documentation.
So you can take a look at the tutorial
of how to use this tool.
You can also show this Help menu with the following commands.
You can show the options for the payload to obfuscate,
so on, and so forth.
But what's the most important here
is the actual obfuscation or encoding techniques.
So the first one is token.
This allows you to obfuscate PowerShell command tokens.
You then have AST, which is what we are going to be using.
And this is for PowerShell version 3 and higher.
That's because the target is running Windows 10,
and this specific technique works probably the best
out of all of them.
You then have your string.
You also have encoding, compress, launcher.
So what do we do now?
Well firstly, we actually need to create
our reverse shell PowerShell script.
So we'll copy the code from the GitHub repository.
This is the reverse shell cheat sheet.
So this is the code I'll copy there.
And I'll then open up a text editor.
So I'll just open up a text editor here,
and I'll paste that code in there, and I'll just zoom in.
And what we want to do is get rid of this particular command
here.
So powershell, nop, and c.
And also the quotation marks.
And I'll get rid of the quotation marks at the end
here.
And I'm going to save this as--
before I actually save it, I need
to change the attacker's IP here to my IP.
So I'll change that to my Kali Linux IP.
So that's 10.10.10.10.
And the port that the target should connect to is port 1234.
And we can now save it.
So I'll save it under my desktop under AVBypass,
and I'll give it the name of shell.ps1, right?
Yeah, we can just call it shell.ps1 and hit Save.
So that saved now.
So what do we do with Invoke-Obfuscation?
How do we load that file?
Well, in order to do this, we can say SET SCRIPTPATH.
And this has to be in uppercase.
So SCRIPTPATH.
And then we specify the path to that PowerShell script.
So in my case, it's on the home, Kali, Desktop, under AVBypass,
and that is shell.ps1.
So I'll hit Enter.
As you can see successfully set the SCRIPTPATH.
It'll then tell it to choose one of the following options.
In my case, I'm going to be using the AST option.
You can take a look at the various options available.
As I said, this is quite a complex tool.
I think I can actually take you through one example
and show you how that works.
So, for example, if I wanted to encode my PowerShell code,
I can say encoding.
That will bring up another menu that provides me
with various encoding options.
So I can encode my code in ASCII, hex, octal, binary,
special characters, whitespace, et cetera.
All right, so for example, I can say ASCII
if I wanted to encode that PowerShell code in ASCII.
I hit Enter, or rather option 1.
Sorry.
That is option 1 instead of ASCII.
So option 1 there.
And you can see it'll output the actual PowerShell code that
has now been encoded in ASCII.
So I can then copy that and save it in a new PowerShell script,
and then transfer that over to the target.
But that's really not what I'm interested in doing now.
So what I'm going to do is I'm just
going to set the script path again here.
So SET SCRIPTPATH.
And again, that is going to be under my home directory
under Kali, Desktop, AVBypass, and shell.ps1.
And if you ever want to open up the documentation, just
type in help.
And so, for example, if we wanted
to clear or reset all obfuscation,
that's very, very important.
I can just say reset if I wanted to take a step back.
There we are.
And again, it's going to tell us no obfuscation has been applied
to the obfuscated command.
So we can also go back using this particular command here.
So I'll just say back.
And we can now obfuscate or set the actual script path,
but that's already set.
So I want to obfuscate PowerShell AST nodes.
So I'll AST.
And I want to use the all options.
So this will select all the choices from above.
So it's going to obfuscate all of the various PowerShell AST
nodes.
So you can see, for example, it's
going to obfuscate the parameter block AST nodes,
the script block AST nodes, attribute AST nodes, et cetera.
So I'll say all.
And then I'm going to say one to execute all obfuscation
techniques, hit Enter.
And this is my new obfuscated code.
So you'll actually see the difference
once I compare them side by side.
So I'll copy that there.
And I'll go back into my text editor
and I'll create a new file.
There we are.
And I'll just paste that in there.
And I'll save this as--
we can just call this obfuscated.ps1.
So this is the obfuscated script.
And you can actually see the difference.
So this is the original code here,
and this is the new code here.
And what it's done is it's obfuscated all the PowerShell
AST nodes.
So now that we've been able to create
a new obfuscated PowerShell script,
we can actually transfer this over to the target system,
and let's see whether we're able to execute it
without any issues.
So I'm just going to split my terminal here.
So I'm going to split it vertically.
We are actually done with Invoke-Obfuscation.
So I'll just exit from PowerShell as well.
Let me just reduce the font size there.
So what we need to do now is we actually
need to host a web server, so that we
can download the obfuscated PowerShell
script onto the Windows target.
We then need to set up a Netcat list now
that will essentially listen for any connection from the target.
And that will tell us whether this was successful.
So netcat -nvlp 1234.
And I'll hit Enter.
I'm then going to--
I'm currently within-- there we are.
So if I list all the contents of this directory,
we have obfuscated.ps1.
So I'll say sudo python 3 and http.server.
And I'll host this on port 80.
I'll provide my password.
And that is Python 3 module.
So there we are.
That's going to start up the web server.
So I'll just switch over to my Windows 10 VM,
and we can take a look at whether or not this works.
All right, so I'm back on the Windows 10 VM.
And as you can see, real-time protection
is enabled for Windows Defender.
The only options I've disabled are
cloud delivered protection and automatic sample submission.
The reason I've disabled automatic sample submission
is in the event that I'm actually
testing some obfuscation techniques,
I don't want Microsoft to send the actual virus
samples or the actual code sample,
as they will create a signature for it immediately
or whenever they get time to do that.
So again, I've left real-time protection on.
So I just wanted to highlight that.
So again, this doesn't mean that it's essentially been disabled.
So if I'm going to-- you can see virus and threat protection
settings, it's saying turn on.
That's just how Windows is.
It wants me to essentially enable these two options here.
But real time protection is still on.
So I just wanted to verify that first to actually confirm
that is the case.
So I'll open up the browser here,
and I'll navigate to the IP address of my Kali Linux VM.
So 10.10.10.10.
Hit Enter.
And I can click on obfuscated.ps1.
That's the obfuscated PowerShell script.
So I'll click on it here and I'll say Save.
As you can see, it ran a security scan,
and it actually finished downloading without any issues.
So it's within my Downloads directory.
So again, if I wanted to run this,
I can just say run with PowerShell.
And if it works successfully, the actual PowerShell code
that we used should actually leave the PowerShell window
or terminal open or running as long as the execution was
successful.
So I'll say run and open.
All right, so it looks like it's working because the PowerShell
window is not closed.
If it was detected, I would get a notification
from Windows Defender, and the PowerShell session
would be terminated.
So let's see if I've obtained a reverse shell.
I'll just switch over to my Kali Linux VM.
All right, so I'm back on Kali.
And as you can see with Netcat, I've received the connection.
And if I hit Enter, I should get a PowerShell session.
So this is a remote or a PowerShell reverse shell.
So again, I can pretty much run whatever commands I want.
And I've essentially gained access to the target system
really simply.
So who am I. You can see msedgewin10, i.e. user.
And I can enumerate this system info here.
So system info.
And that will just display or tell me what version of Windows
exactly is running.
So Windows 10 Enterprise Valuation Build 17763.
So this technique works on this version, as well as
a couple of newer versions.
However, you may want to use Invoke-Obfuscation
to take a look at the other techniques
that you can use in regards to encoding and obfuscation
of your PowerShell code.
So that is going to conclude the practical demonstration
side of this video.