There are multiple open source tools available online that can generate and/or obfuscate PowerShell-based payloads for penetration testing. This list includes, but is not limited to, the following:
- PowerSploit
- PowerShell Empire
- Nishang
- MSFvenom (part of Metasploit)
- Veil
- Invoke-Obfuscation
Any text editor with the corresponding syntax highlight can be used for static analysis.
PowerShell has a powerful embedded help tool that can be used to get the description for any command. It can be obtained by executing a Get-Help <command_name> statement:
Figure 12: Getting a description for a PowerShell command
Don't forget that PowerShell commands are executed through the Windows console, so pretty much any obfuscation technique we described previously can be applied here as well. In addition to this, there are several other simple obfuscation tricks that have proved to be popular:
- Multiple string concatenations with either a basic + syntax with actual...