getrektboy724 / meterpwrshell

Automated Tool That Generates The Perfect Meterpreter Powershell Payload

Inactive Tool - Reason : busy with something else

   _____          __              __________                _________.__           .__  .__  ________  
  /     \   _____/  |_  __________\______   \_  _  ________/   _____/|  |__   ____ |  | |  | \_____  \ 
 /  \ /  \_/ __ \   __\/ __ \_  __ \     ___| \/ \/ |_  __ \_____  \ |  |  \_/ __ \|  | |  |  /  ____/ 
/    Y    \  ___/|  | \  ___/|  | \/    |    \     / |  | \/        \|   Y  \  ___/|  |_|  |_/       \ 
\____|__  /\___  >__|  \___  >__|  |____|     \/\_/  |__| /_______  /|___|  /\___  >____/____|_______ \
        \/     \/          \/                                     \/      \/     \/                  \/   

MeterPwrShell2

Automated Tool That Generate A Powershell Oneliner That Can Create Meterpreter Shell On Metasploit,Bypass AMSI,Bypass Firewall,Bypass UAC,And Bypass Windows Defender.

This tool is powered by Metasploit-Framework and OnlineAMSIFail

Notes

• DONT BE A FUCKING SKID!
• NEVER UPLOAD THE PAYLOAD THAT GENERATED BY THIS PROGRAM TO ANY ONLINE SCANNER
• NEVER USE THIS PROGRAM FOR MALICIOUS PURPOSE
• SPREADING THE PAYLOAD THAT GENERATED BY THIS PROGRAM IS NOT COOL
• ANY DAMAGE GENERATED BY THIS PROGRAM IS NOT MY (As the program maker) RESPONSIBILTY!!!
• If you have some feature recommendation,post that on Issue
• If you have some issue with the program,try redownloading it again (trust me),cause sometimes i edit the release and fix it without telling 😂
• Dont even try to fork this repository,you'll dont get the releases!
• For everyone who has issue or want to contact me,pls use Discord. My Discord ID is : GetRektBoy724#1337
• This tool is not fully Open-Source (i guess),yes you can redistribute it as much as you want but you'll never get the source code of the tool (dont ask me why)

Features (v2.0.0)

• Automatic Migrate (using PrependMigrate)
• AutoGetSYSTEM (Automaticly escalates privilege from normal user to SYSTEM)
• Disable All Firewall Profile (If you use AutoGetSYSTEM feature)
• Fully Bypass Windows Defender Real-time Protection
• Disable Windows Defender Security Features (If you use AutoGetSYSTEM feature)
• Fully unkillable payload (If you use Automatic Migrate feature)
• Bypasses AMSI Successfully
• Short One-Liner
• Bypass Firewall (If you pick an unstaged payload)
• Great CLI
• A Lot More (Try it by yourself)

---

All payload features is tested on Windows 10 v20H2

---

Advantages Of MeterPwrShell Compared To The web_delivery Module From Metasploit Framework

• Shorter stager (Or short one-liner in this case)
• Dont need to setup a server for the stager
• Support Ngrok built-in (so the victim doesnt need to be on the same local network)
• Automatic Built-in Privesc
• Easily Bypass Windows Defender

Thanks to

• Every single of my Discord Friends
• Special Thx to theia#8536 on Discord
• @FuzzySec for that awesome Masquerade PEB script
• @decoder-it for that amazing PPID Spoofing script
• Me for not dying when creating this tool
• Ed Wilson AKA Microsoft Scripting Guy for the great Powershell scripting tutorials
• and the last one is Emeric Nasi for the research on bypassing AV dynamics

Requirements

• Kali Linux,Ubuntu,Or Debian (If you dont use on of those,the tool will not work!!!)
• Metasploit Framework
• Internet Connection (Both On Victim And Attacker Computer)

this tool is tested on :

• Debian 10 buster
• Kali Linux 2021.1 and 2020.3
• Ubuntu 20.04 LTS

Installation

just fucking download your binary on Release page and please choose your binary according to your OS. i386 and all arm architecture is not supported yet.

Usage

# ./MeterPwrShell2Kalix64 -c help
 Available arguments : help, version, showbanner, showlastdebuglog                                
 help : Show this page                                                                                                                                                
 version : Show MeterPwrShell's version                                                                                                                               
 showbanner : Show MeterPwrShell's Banner                                                                                                                             
 showlastdebuglog : Well,Its kinda self-explanatory tho                                                 
 noaptupdate : By default,MeterPwrShell run 'apt-get update' every single time it executed,and this argument disable it.

You also can use MeterPwrShell Without Any Flags And Arguments

To-do List

• fix AutoGetSYSTEM feature
• fix any single goddang false positive
• implement applocker bypass
• fix my lazyness
• implement universal API unhooker (dem bois this one is going to be hard,especially for Powershell attack vector)

meterpwrshell's Issues

No Reverse Connection

Hey,
Thanks for that tool. I just tried it, but no connection succeeded.
I tried it without NGrok, only in my local NW.

If i execute the output on my Windows Machine nothing happend.

Maybe i do something wrong.

THX

Path Question

My ubuntubash path is not in /usr/bin/bash, but /bin/bash, but I cannot modify the path

expired :(

wrong shc -e ?((

no reverse connection

thanks for the great tool , really i appreciate you , but i face some issue

1- every time it said cowsay not installed and install it every time
2- every time it askabout metasploit path
3- my payload is windows/meterpreter/reverse_tcp
4- when i choosedthe payload iget this [---] Checking Payload Availability . . . [---] Traceback (most recent call last): 4: from /usr/bin/msfvenom:414:in

'
3: from /usr/bin/msfvenom:414:in each' 2: from /usr/bin/msfvenom:417:in block in '
1: from /usr/bin/msfvenom:417:in puts' /usr/bin/msfvenom:417:in write': Broken pipe @ io_write - (Errno::EPIPE)
[---] Payload Available On Metasploit [---]
`
5- i didnt get any reverese connection
6- i didnt find .debug.log in the same folder

question

Reverse_tcp using msf can connect back, but cannot execute related commands

cant answer so fast, sorry ;)

❯ ./meterpwrshellexec
./meterpwrshellexec: �ק�|f�J�Q�
�� �has expired!
Please contact your provider [email protected]

curl problem ?

curl: Can't open '1.ps1'!
curl: try 'curl --help' or 'curl --manual' for more information
./meterpwrshellexec: line 1166: warning: command substitution: ignored null byte in input

Probably architecture or OS problem

Sorry, I don’t quite understand why it is like this after I run him