All language subtitles for [English (auto-generated)] How to manually obfuscate PowerShell scripts [DownSub.com]

many people expressed their interest to

learn more about obfuscation techniques

so I decided to create a repository of

all the tricks I know and use in

penetration testings to obfuscate powers

and scripts this repository has a little

bit of theory in it as well so before we

dive into practical examples let's talk

a little bit about entropy a

generalization of entropy's definition

is the measure of Randomness or disorder

of a system okay and in information

Theory this actually means the measure

of Randomness in a set of data and you

might be wondering what the hell does

that have to do with AV evasion or

Powershell obfuscation whatever okay so

here's why I'm mentioning this this is

because malware often contains code that

is highly randomized right it's many

times it's encrypted and coded

officiated with many different

techniques that tend to make a payload

unrecognizable very difficult to process

either by a human or even a machine a

computer right to make it difficult to

analyze and therefore detect so imagine

if there was a form formula that you

could pass a specific data set okay and

with some mathematical calculation you

could determine the measure of

randomness of a given data set like a

payload for example a malware or

whatever okay and you could say that hey

you know what this the randomness of

this thing is 5 or it's 10 or it's 8.

then you could statistically create

models to kind of predict when a file or

payload is malicious and this is exactly

one of the methods that antivirus

products use entropy analysis to

identify potentially malicious files

because a file that has a very high

measure of Randomness is probably a

malicious or at least it has many more

chances to be malicious compared to

other files and with other parameters

and Analysis techniques I I guess you

can determine if something is a malware

or whatever a mathematician and computer

science is named Claude sanon introduced

a formula many years ago with which you

can measure the entropy in a set of data

and I think it's really important for

someone into AV vision and Pen testing

generally speaking with teaming and

stuff like that to know this concept

because you can actually use this

formula it's a you can find python

implementations here and in many other

sources it's not something I wrote I

edited something that I found online

because actually this is a mathematical

formula so anyone can express it in any

programming language which convenient

for him there are also online

calculators this actually is describing

this uh the sun on entropy is called

this formula and there is a calculator

down here to use and we're gonna use it

very soon and I think it's really

important to have it in mind because you

might you might obfuscate something

using all of these tricks and many more

you can find everywhere on the internet

today and you you will be able to bypass

I think very easily many of the common

antiviruses we all have and utilize in

our computers but sophisticated systems

will see through these payloads that you

probably develop using multiple uh

office location techniques just because

of entropy of course there are many

other variants in this equation but I

think entropy places a significant part

and it's something you can control you

can there are tricks to lower it and you

can be careful with what you choose to

modify in the script to not fall in the

Trap of being identified because of very

high entropy in your payload and let me

just really quickly show you an example

of how a little bit entropy works okay

this is an entropy calculator this is

the result here entropy okay so it has

this example Laura nipsum you know the

classic string and it has an entropy

let's say of 3.99 okay let's forget

about this example and let's create a

data set okay and this could be a

payload right in here we will measure

something later okay so let's say we

have the data set that is just Four A's

okay this will actually have an entropy

of zero because there's actually no

Randomness in this this absolutely it's

just super predictable it's four

instances of a okay so let's just add B

okay so let's calculate and we'll see

that entropy starts to rise right and as

many unique characters you add to this

data set it will go up okay and let's

see just to understand a little bit just

the feeling of this The Taste the flavor

of this of this thing called entropy

let's add a lot of more A's okay and we

are two right now

and you'll see that we the the entropy

fell because now our data set has less

Randomness because most of the

characters in this whole data data set

probably you understand that this has

also this calculation on this formula

has to do also with the length the

length of the data set okay

so our data set grew but it grew Less in

Randomness because it has more uh

similar characters and of course

the more weird things are

entropy will rise this is exactly what

happens with a payload for example when

you grab a reversal command and you

start obfuscating you're adding weird

stuff in it encryption encoding uh weird

variable names weird class names all of

this juicy stuff we do to bypass

antiviruses and you should have in mind

that this is also something that is

happening uh behind the scene and

Antivirus products actually measure this

and

statistically they can calculate and say

hey this is probably this is probably

malware more details about this are in

the power cell obfuscation Bible you can

find and read stuff about it here but

let's for the sake of this video and for

it not to be super long and boring let's

just jump into practical examples so

let's check out some of these techniques

let's go to rename objects I think it

should be a priority to replace

variables and class and function names

with random ones within a script that

you are trying to obfuscate and bypass

detection and everything okay so here we

have a classic Powers reverse cell

command just for an example and I have

done this actually I have replaced the

the variable names because there are no

class or function definitions in this

particular reversal command and I also

only change this part here PWD dot path

which Returns the current working

directory with the get location GL the

the alias in parcel and actually this

worked and this is the case in many

times at least for me the the test I run

I have noticed that if I most of the

times since the object names in a script

and I just used one of these other

techniques additionally to obfuscate

something usually I'm already there and

let's just use villain which is a tool

that can generate a reversal commands

and also it has some listeners you can

see netcat TCP hoaxel and we can catch

multiple cells and I'm gonna just use it

uh to generate a

this particular command that we were

just observing windows netcat power cell

lhost equals at zero it's just the same

exactly template actually I'm lying is

not exactly the same oh I already have

it here okay let's use this one

the difference here is that this one has

this wrapper to start as a new process

and I don't really want it right now

because we won't be able to see error

messages and I want to see error

messages because this is actually

detected because it's raw it's I mean

it's the template that is super flag

they it has I don't know

I don't think there's a solution an

antivirus product that cannot cut this

cell okay and let me just show you

really quickly

my virus signatures what's happening

throw again whoa whoa

severe right now okay so my wireless

signatures are up to date and

uh my settings my sales are all up and

just to be quick I'm gonna use a script

to automatically randomize all the

variables in this payload I've used this

script before in other videos and but I

never included it somewhere on GitHub

and uh here in this repository you can

find it it's far from perfect and if you

execute this against the script that is

large probably it will destroy it well

given the architecture of the script if

there's something weird and it replaces

something it shouldn't because I thought

it's a variable or something but

whatever maybe someone can perfect

perfect this thing and just do a pull

request or something I don't know let's

use it

I have it um

where is it

we want to run the script and pass as a

command line argument the standard

reversal template and let's do this from

power cell

the script is in

desktop payload which is unexcluded from

the antivirus directory on my system

should not be saying this but anyway you

can do this if you go here and add an

exclusion you can just choose a path

that you don't want to be scanned and

I've done this before because I have

myself up and running and I don't want

it to be scanned right now and let's uh

or is it okay python let's do randomized

variables and we want to do this on the

standard reversal template and this is

just gonna print the payload again but

this time the variable names are random

and this alone will not work

I'm gonna showcase this really quickly

because I've done it before and I feel

end of boards so if I run this it's

still detected so if we just jump into

another technique something really

reasonable I think

but I also describe somewhere here

uh where is it substitute commands Okay

you can just substitute a command that

you know an equivalent of it for example

I mentioned that this this is the

template we are working on is PWD dot

path that Returns the current working

directory can be replaced with many

things like DL get location and this

analysis for get location for this or

probably actually these two also this

very long script I've I've added here as

an example but let's not be you know

let's just do something simpler I'm

gonna clear here because now we're gonna

get ourselves finally hopefully

uh what is uh Power Cell

so we have the script it's still not

working it's it's still detected but

if we do this really small change

that I mentioned

with get location we are gonna fly off

the radar and of course this is not

something this might bypass Defender

here on this uh on my machine that is

not in a mature Network like security

wise and uh it would probably not work

against some endpoint detection but if

you take into consideration of the

entropy because you can see that this

thing based on the example we mentioned

earlier

all these random stuff and length

probably made the entropy of this

payload go up and there are ways to make

it go lower and maybe this would work

actually in test I've done it did work

against edrs that way so you should read

the repository in detail because I have

some comments on this I'm not gonna

associate this showcase this right now

so let's stop going random let's do the

mature thing here which is to identify

detection triggers meaning strings Parts

in this script that is actually

flagged as malicious because it's not

like everything every component of a

script is flagged it's usually some

particular part of it because this would

like destroy the functionality of

anything else that is normal issues

right so let's uh let's use ampsi

trigger which I have it here it's a tool

you can just download for game from

GitHub just search for ampsi trigger it

can highlight for you if you do this if

format 3 I think it means it will

highlight with red the part of the of

the

payload that you insert that you input

as a file uh and this is the standard

reversal template that we're working

with right this the classic one without

changed variables nothing

let's just run it

when it's when it's kind of hanging I

have noticed that if you

uh stop Cloud delivery protection it

will not hang and it will just tell us

what is the problem I think yes it

worked

I'm not sure why

uh let's turn it back on because I want

everything to be enabled so it says that

this part is what it doesn't like so

let's choose some technique and just

mess with this part which is like a 90

95 of this payload whatever I thought it

would be shorter but it doesn't matter

let's do this get command technique

which is really awesome

so here's the thing with uh get command

let's open a new partial window if I do

get

command

this will just drop everything every

commandlet and every I think executable

that is in the path bar environmental

variable on my machine okay and uh

here's the trick with this you can use

it

entity

CCM yes get command is an alias for this

you can use it for example this would

return ex also you can use wildcard

wildcards with this this also returns EX

for example and you can do weirder stuff

as well of course like

invoke

uh X

I guess yes this also would return ex

and of course you can just grab this

because it's a it's an object a string

you can just grab the name of it

or you can just without grabbing the

name uh run it as a job okay and this is

ex right now actually so we can

replace ex with this and probably

hopefully

this will work because this pedal has ex

here if we do this we have messed with

this part that is red it's not 100

percent

I'm not sure this is going to work but

it's worth trying so let's

drum roll and boom Oh

worked

it didn't work but okay we're getting

there

let's see in combination with um

where is it oh yeah

in combination with what we did we did

earlier

okay CL and now we have not changed any

variables nothing it's quite similar to

what it is originally

still doesn't work

let's see what else we can combine

we could try to add comments I mentioned

this also in the repository you can just

go to some random places and add

comments and let's

add some random string in this

moment and let's let's add one more

somewhere

for example here

okay oh it actually worked

and we must have gotten a new Vector

session here on villain

Let's test it one more time to be sure

let me just kill

this session

return because it was hanging and I

could not control C out of this so I'm

gonna run it one more time

and you can see we actually combined

like three techniques we didn't change

any variable names nothing we just added

some comments we did this uh get command

substitution of e x okay

and this wildcard thing it gives you

Endless Possibilities to get the command

you want endless okay that was an

overstatement but it gives you a lot of

ground to work with and of course this

is a good location and you see we

actually managed to mess with this also

this uh adding comments is a great way

to mess with the entropy of a pellet and

let's go back to our calculator I'm

gonna just slap this in okay now we can

calculate it has an entropy of 5 which

is kind of high I think

not that much it could be of course

higher but it is high and let's see

check this out

as we showed earlier with a simple

example I added A's okay and

this was actually dropping the

entropy because the randomness is

decreasing because we have less random

characters right this again

you can see that it dropped it actually

and this payload which would have longer

comments it doesn't really matter

I'm gonna just slap of this and now we

have dropped a lot in entropy and this

payload actually and again

let's go villain and let's fill this

session also

to unhang our cell here and I'm gonna

slap this in just for you to see that it

actually will work

so this is a cool way to to drop the

entropy and you know

combine a few techniques combine a few

tricks to also drop the entropy and who

knows maybe even in sophisticated

environments with endpoint detection

stuff maybe you will have a chance to

not be detected and you can also take

this template that we just created and

uh

pass it in villain replace the the

pellet and plate that it has to generate

this standard one that is actually

uh detected this one you can replace it

I have made a video about this you can

find it and check this out so you can

combine these two

like this knowledge base this repository

this demonstration and just create your

own obfuscated templates and you will

not have to worry for it getting

detected after one week especially if

you spend some time to create something

really unique so hopefully you will find

this useful there's a lot of details in

all these things that I just really

quickly demonstrated right now I have to

go for vacation with sister and uh I'm

gonna publish this robot story right

after this video is finished I have to

do some editing if you like it make sure

to support this project and me as well

maybe you can just follow me or not

whatever do whatever you want it doesn't

matter this is for penetration testers

and red teamers and blue teamers and

people interested in cyber security

don't be evil don't use this to gain

access to systems that you should not

have access to except if someone asks

you to do it for testing reasons of

course and I hope you enjoyed this video

and thanks for watching