anthrax3 / reversepowernoid

Reverse TCP Powershell has never been this paranoid. (basically an Opsec-safe reverse powershell)

ReversePowernoid

ReversePowernoid is a reverse TCP C#-based Powershell, and it's really paranoid about Powershell's security and defense system. ReversePowernoid will disable CLM (Constrained Language Mode), ETW (Event Tracing for Windows), SBL (Script-Block Logging), and AMSI (Anti-Malware Scan Interface) at startup, if it fails to disable one of them, it automatically aborts the process and quits and obviously, it will not connect to the server/attacker. The TCP traffic will be encrypted with AES with a hardcoded key (I know its a pretty bad idea, but its good enough for now). Oh and dont expect some fancy-ass shit in here ;)

Inspired by mgeeky's Stracciatella

Usage

You can change the password for the TCP encryption (optional) by changing the public variable named "Password" on both client and server source code. You can change the IP Address and port where the server listens on HardcodedServerAddress and HardcodedServerPort variable on the client source code. By default, the server binds to 0.0.0.0 address and you need to set port manually by feeding it to the program by command line argument (for example : ./server.exe 1234). The server can be compiled on both Mono and .NET Framework's C# compiler. When compiling the client source code, dont forget to add System.Management.Automation reference (DLL can be found on : C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll).