lucabongiorni / psattackbuildtool Goto Github PK

A tool that makes it easy to compile a custom version of PS>Attack, a portable powershell attack environment.

The build tool downloads the latest version of PS>Attack and the latest versions of tools that is uses (PowerSploit, Powercat, Inveigh, etc) and encrypts them with a custom key. It then compiles everything, producing a custom version of PS>Attack that's up to date and consists of unique file signatures, making it very difficult for Antivirus and Incident Response teams to find.

PS>Attack is a self contained custom PowerShell console that comes with a lot of the latest and greatest offensive PowerShell tools. It's designed to make it very easy for Pentesters to incorporate PowerShell into their workflow. It's suitable to be used on live engagements as it's capable of evading Antivirus and Incident Response teams with the following tricks.

1. It doesn't rely on powershell.exe. Instead it calls powershell directly through the .NET framework.
2. The modules that are bundled with the exe are encrypted. When PS>Attack starts, they are decrypted into memory. The unencrypted payloads never touch disk, making it difficult for most antivirus engines to find them.
3. When generated by the PS>Attack Build Tool, the payloads are encrypted with a unique key. This means that the generated executable's signature changes each time it's created.

You can find more information about PS>Attack at its github page

If you have any questions or suggestions for PS>Attack or its Build Tool, feel free to submit an issue or reachout on twitter or via email: jaredhaight at prontonmail.com

PS>Attack was inspired by and benefits from a lot of incredible people in the PowerShell community. Particularly mattifiestation of PowerSploit and sixdub, engima0x3 and harmj0y of Empire. Besides writing the modules and commands that give PS>Attack it's punch, their various projects have inspired alot of my approach to this project as well as my decision to try and contirbute something back to the community.

A huge thank you to Ben0xA, who's PoshSecFramework was used to figure out a lot of things about how to build a powershell console.