Gh0st
/
PowerSploit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed mangled decrypted script output 

Addresses issue #80. This was a tricky fix because the script should
ideally handle Unicode and Ascii encoded scripts. I haven't tested
scripts with international characters but I would imagine those script
would get mangled since the decrypted output is ultimately normalized to
ascii.
This commit is contained in:
Matt Graeber 2015-12-16 10:15:14 -08:00
parent fdcdeab702
commit 9a2dfad3de
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ScriptModification/Out-EncryptedScript.ps1
View File

@ -90,7 +90,7 @@ This command can be used to encrypt any text-based file/script
$AsciiEncoder = New-Object System.Text.ASCIIEncoding $AsciiEncoder = New-Object System.Text.ASCIIEncoding
$ivBytes = $AsciiEncoder.GetBytes($InitializationVector) $ivBytes = $AsciiEncoder.GetBytes($InitializationVector)
# While this can be used to encrypt any file, it's primarily designed to encrypt itself. # While this can be used to encrypt any file, it's primarily designed to encrypt itself.
[Byte[]] $scriptBytes = [Text.Encoding]::ASCII.GetBytes((Get-Content -Encoding Ascii -Path $ScriptPath)) [Byte[]] $scriptBytes = Get-Content -Encoding Byte -ReadCount 0 -Path $ScriptPath
$DerivedPass = New-Object System.Security.Cryptography.PasswordDeriveBytes($Password, $AsciiEncoder.GetBytes($Salt), "SHA1", 2) $DerivedPass = New-Object System.Security.Cryptography.PasswordDeriveBytes($Password, $AsciiEncoder.GetBytes($Salt), "SHA1", 2)
$Key = New-Object System.Security.Cryptography.TripleDESCryptoServiceProvider $Key = New-Object System.Security.Cryptography.TripleDESCryptoServiceProvider
$Key.Mode = [System.Security.Cryptography.CipherMode]::CBC $Key.Mode = [System.Security.Cryptography.CipherMode]::CBC
@ -126,7 +126,8 @@ function de([String] `$b, [String] `$c)
`$i.Close(); `$i.Close();
`$j.Close(); `$j.Close();
`$f.Clear(); `$f.Clear();
return `$encoding.GetString(`$h,0,`$h.Length); if ((`$h.Length -gt 3) -and (`$h[0] -eq 0xEF) -and (`$h[1] -eq 0xBB) -and (`$h[2] -eq 0xBF)) { `$h = `$h[3..(`$h.Length-1)]; }
return `$encoding.GetString(`$h).TrimEnd([Char] 0);
} }
"@ "@