PoshC2_DLLS

AMSI Bypass & ETW Bypass included in Sharpv2 and Sharpv4 Shellcode

• https://github.com/rasta-mouse/AmsiScanBufferBypass
• https://blog.xpnsec.com/hiding-your-dotnet-etw/

Posh uses sRDI and Binary Patching

• https://github.com/monoxgas/sRDI/blob/master/PowerShell/ConvertTo-Shellcode.ps1
• https://redteaming.co.uk/2020/07/05/poshc2-shellcode-and-binary-patching/

Output files needed for "/opt/PoshC2/resources/payload-templates/"

• resources/payload-templates/Sharp_v2_x86_dll.b64

• resources/payload-templates/Sharp_v2_x64_dll.b64

• resources/payload-templates/Sharp_v2_x86_Shellcode.b64

• resources/payload-templates/Sharp_v2_x64_Shellcode.b64

• resources/payload-templates/Sharp_v4_x86_dll.b64

• resources/payload-templates/Sharp_v4_x64_dll.b64

• resources/payload-templates/Sharp_v4_x86_Shellcode.b64

• resources/payload-templates/Sharp_v4_x64_Shellcode.b64

• linux_implant