From 871502376c7594249a90f4fa48ebdbfaf8fb8438 Mon Sep 17 00:00:00 2001 From: z0noxz Date: Mon, 17 Apr 2017 16:18:48 +0200 Subject: [PATCH 1/2] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6797af5..04e1fd8 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Description ----------- This script creates an executable stager that downloads a selected powershell payload, loads it into memory and executes it using obfuscated EC methods. The script will also encrypt the stager for dynamic signatures and some additional obfuscation. -This enables the actual payload to be executed indirectly without the victim downloading it, only by executing the stager. The attacker can then for example implement sandbox evasion on the web server, hosting the payload, instead of in the stager itself. +This enables the actual payload to be executed indirectly without the victim downloading it, only by executing the stager. The attacker can then for example implement evasion techniques on the web server, hosting the payload, instead of in the stager itself. Additional methods allows the payload to be embedded into the 'stager' and temporarily stored encrypted on disk for memory injection. @@ -40,4 +40,4 @@ Generate an embedded custom payload: powerstager -t win64 -o out.exe -p input.ps1 ## DISCLAIMER: -You shall not misuse this tool to gain unauthorized access. This tool should only be used to expand knowledge, and not for causing malicious or damaging attacks. Performing any attacks without written permission from the owner of the system is illegal. \ No newline at end of file +You shall not misuse this tool to gain unauthorized access. This tool should only be used to expand knowledge, and not for causing malicious or damaging attacks. Performing any attacks without written permission from the owner of the system is illegal. From fd239c7de58ec2ca031fd0f39b95361ca6bdffa5 Mon Sep 17 00:00:00 2001 From: z0noxz Date: Mon, 17 Apr 2017 16:19:20 +0200 Subject: [PATCH 2/2] Update powerstager.py --- powerstager/powerstager.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/powerstager/powerstager.py b/powerstager/powerstager.py index e144b92..56ac012 100755 --- a/powerstager/powerstager.py +++ b/powerstager/powerstager.py @@ -22,7 +22,7 @@ help_notes = """ This enables the actual payload to be executed indirectly without the victim downloading it, only by executing the stager. The attacker can then for - example implement sandbox evasion on the web server, hosting the payload, + example implement evasion techniques on the web server, hosting the payload, instead of in the stager itself. Additional methods allows the payload to be embedded into the 'stager' and