Living off the land with PowerShell

“You are like a baby. Making noise. Don’t know what to do.”

– Neytiri in Avatar

So, you have some tasty shellcode, and you need it executed. You could just spit out an executable from msfvenom, but I don’t think there’s an antivirus product in the world that wouldn’t catch that. We’ve also worked with dynamic injection with Shellter, and we’ll look at even more parasitizing of innocent Portable Executables (PEs) later in this chapter – but again, we’re putting our instructions inside a binary, hoping to sneak past AV after it rules the program is safe. Scripts, on the other hand, aren’t machine code. They’re higher-level instructions that have to be interpreted – the actual machine code is running in the interpreter. It isn’t foolproof by any means, and the AV vendors have been on to us scripters for a while now. However, it adds an enticing...