only certificated scripts allowed

[eCrofey]

I'm little bit disappointed there 're not much scripts for W8 or W10 and most of the Exploits for W8 or W10 're already patched.So I can't really use the Bash Bunny 
To this comes also that in most interesting places only certified power shell scripts are allowed.
I don't know if there are a way to bypass the certificate. 

 

[PoSHMagiC0de]

I believe the signed with a valid cert scripts thing can be bypassed, if you are local admin, with the parameter "-ExecutionPolicy Bypass" or "-Exec Bypass" for short.  Also, if the script is being typed from the command line, it does not have to be signed, only if you are running it from a file.  So another way around it is to have the BB type out a download cradle for your script which will load it into memory as a string (not string array, if you are ending up with a string count of more than 1 then pipe that out the "out-string" to make it a solid here-string) where you can then execute it.  Execution policy doesn't affect code in memory, only code on the disk.

Take a look at other payloads, some do just this.  I believe Darrin's exfiltration script does this also.  The BBTPS does but maybe more confusing to read since I have it staying up for a certain number of heartbeats to give time for the BB network to come online and dying if it times out.

[eCrofey]

Thanks I will check it out !