Skip to content
This repository has been archived by the owner on Jan 29, 2020. It is now read-only.

Error With Ampersand Character in Stager #798

Closed
p3nt4 opened this issue Nov 6, 2017 · 2 comments
Closed

Error With Ampersand Character in Stager #798

p3nt4 opened this issue Nov 6, 2017 · 2 comments

Comments

@p3nt4
Copy link
Contributor

p3nt4 commented Nov 6, 2017

Empire Version

2.3

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

Hi, I am trying to launch an empire stager through powershell runspaces in c#
(https://github.com/p3nt4/PowerShdll).

rundll32 Powershdll.dll,main $a = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("BASE64LAUNCHER")); Invoke-Expression $a

The ampersand in the stager is causing an error (please see below).

Is it possible to replace that symbol by a command?

Screenshot of error, embedded text output, or Pastebin link to the error

At line:1 char:2939
+ ... . . $ d A T a . l E N g t H ] ; - J o I n [ C h a r [ ] ] ( &   $ R   ...
+                                                                 ~
The ampersand (&) character is not allowed. The & operator is reserved for future use; wrap an ampersand in double quotation marks ("&") to pass it as part of a string.

Any additional information

This is not an Empire issue per say but any help would be appreciated.
Thank you.

@xorrior
Copy link
Contributor

xorrior commented Nov 6, 2017

@p3nt4 You try escaping with ` .

@xorrior xorrior closed this as completed Nov 6, 2017
@p3nt4
Copy link
Contributor Author

p3nt4 commented Nov 6, 2017

Thanks @xorrior for the reply. Escaping the ampersand does not work.
Decoding as ASCII caused the error. Using UNICODE did the trick.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants