Forum Discussion

5 Replies

  • I used python for this, most likely you can use a PowerShell program, too.

      • netcat's avatar
        netcat
        Icon for Silver III rankSilver III

        Well, start with "${       }".  You know what this is, isn't it? And "+=", "${}", etc.?
        If not, read the PowerShell specification, or play with in PowerShell to get an understanding what happens.

        All in all, very ugly, but not impossible to decode.
        I can't (well I could) post my decoder here, so can't really give details on how I did it.

  • GusC's avatar
    GusC
    Icon for Bronze III rankBronze III

    Try 

    Set-PSDebug -Trace 1

    and put 

    Write-Output to the beginning of the script and then running it in a console. 

    you should then get a lot of CHAR output. 

    Put that in CyberChef and decode from there. 

    The labs change every time though as they use invoke obfuscation during vm spinup