Skip to content
This repository has been archived by the owner on Jan 8, 2024. It is now read-only.

Rex::Powershell::Command.compress_script generates not working payloads #9

Closed
phra opened this issue Jan 14, 2019 · 0 comments · Fixed by rapid7/rex-powershell#16
Closed
Labels

Comments

@phra
Copy link

phra commented Jan 14, 2019

Rex::Powershell::Command.compress_script generates payload that are not working on win 10 1803. after some debugging i discovered that:

  • the current generated payload is

( NeW-OBJeCT iO.streAmreaDER( ( NeW-OBJeCT Io.ComPreSsioN.dEfLATEStReAm( [SYsTEM.Io.MEMOrYstReam][coNvERT]::FROmBase64sTRinG('S03OyFdIzkzMV6hRyC8t0U3LzElVAJMFiSUZCslWMaXFqUXFMQWlSTmZyTEpmfnJiXmpeiUVJQA=') ,[sYStEM.Io.cOMpreSSiON.coMprEssIONMoDe]::decoMPrEss)) ,[systEM.TeXT.EncoDIng]::ASCii) ).reAdtoEnD( )| Write-Host

  • but the working version is

( NeW-OBJeCT system.iO.streAmreaDER( ( NeW-OBJeCT system.Io.ComPreSsioN.dEfLATEStReAm( [SYsTEM.Io.MEMOrYstReam][system.coNvERT]::FROmBase64sTRinG('S03OyFdIzkzMV6hRyC8t0U3LzElVAJMFiSUZCslWMaXFqUXFMQWlSTmZyTEpmfnJiXmpeiUVJQA=') ,[sYStEM.Io.cOMpreSSiON.coMprEssIONMoDe]::decoMPrEss)) ,[systEM.TeXT.EncoDIng]::ASCii) ).reAdtoEnD( )| Write-Host

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants