Forum Discussion

PRABAKARANRAMAMURTHY's avatar
PRABAKARANRAMAMURTHY
Icon for Advocate rankAdvocate
10 months ago
Solved

PowerShell Deobfuscation: Ep.8 - Stuck Halfway

I was working on Ep.8 of PowerShell Deob. Got stuck in second step. Step 1: Base64 & RAW Inflate (Twice)   Step 2: Stuck with this weird looking code. Tried to run with PowerShell and received...
challenges
defensive cyber
immersive labs
questions & feedback
  • GusC's avatar
    GusC
    5 months ago

    Try 

    Set-PSDebug -Trace 1

    and put 

    Write-Output to the beginning of the script and then running it in a console. 

    you should then get a lot of CHAR output. 

    Put that in CyberChef and decode from there. 

    The labs change every time though as they use invoke obfuscation during vm spinup 

     

netcat's avatar
netcat
Icon for Advocate rankAdvocate
10 months ago

Well, start with "${       }".  You know what this is, isn't it? And "+=", "${}", etc.?
If not, read the PowerShell specification, or play with in PowerShell to get an understanding what happens.

All in all, very ugly, but not impossible to decode.
I can't (well I could) post my decoder here, so can't really give details on how I did it.