aboutsummaryrefslogtreecommitdiff
path: root/ScriptModification/Out-EncryptedScript.ps1
diff options
context:
space:
mode:
authorMatt Graeber <mattgraeber@gmail.com>2015-12-16 10:15:14 -0800
committerMatt Graeber <mattgraeber@gmail.com>2015-12-16 10:15:14 -0800
commit9a2dfad3de260977138f536b1332404ea1bf5db8 (patch)
tree5408552718522e47e5dd917d5b7f08f860d85345 /ScriptModification/Out-EncryptedScript.ps1
parentfdcdeab7020e5c18be1c12a4526f90b2c0cdb6bb (diff)
downloadPowerSploit-9a2dfad3de260977138f536b1332404ea1bf5db8.tar.gz
PowerSploit-9a2dfad3de260977138f536b1332404ea1bf5db8.zip
Fixed mangled decrypted script output
Addresses issue #80. This was a tricky fix because the script should ideally handle Unicode and Ascii encoded scripts. I haven't tested scripts with international characters but I would imagine those script would get mangled since the decrypted output is ultimately normalized to ascii.
Diffstat (limited to 'ScriptModification/Out-EncryptedScript.ps1')
-rw-r--r--ScriptModification/Out-EncryptedScript.ps15
1 files changed, 3 insertions, 2 deletions
diff --git a/ScriptModification/Out-EncryptedScript.ps1 b/ScriptModification/Out-EncryptedScript.ps1
index 1764d17..eba48f7 100644
--- a/ScriptModification/Out-EncryptedScript.ps1
+++ b/ScriptModification/Out-EncryptedScript.ps1
@@ -90,7 +90,7 @@ This command can be used to encrypt any text-based file/script
$AsciiEncoder = New-Object System.Text.ASCIIEncoding
$ivBytes = $AsciiEncoder.GetBytes($InitializationVector)
# While this can be used to encrypt any file, it's primarily designed to encrypt itself.
- [Byte[]] $scriptBytes = [Text.Encoding]::ASCII.GetBytes((Get-Content -Encoding Ascii -Path $ScriptPath))
+ [Byte[]] $scriptBytes = Get-Content -Encoding Byte -ReadCount 0 -Path $ScriptPath
$DerivedPass = New-Object System.Security.Cryptography.PasswordDeriveBytes($Password, $AsciiEncoder.GetBytes($Salt), "SHA1", 2)
$Key = New-Object System.Security.Cryptography.TripleDESCryptoServiceProvider
$Key.Mode = [System.Security.Cryptography.CipherMode]::CBC
@@ -126,7 +126,8 @@ function de([String] `$b, [String] `$c)
`$i.Close();
`$j.Close();
`$f.Clear();
-return `$encoding.GetString(`$h,0,`$h.Length);
+if ((`$h.Length -gt 3) -and (`$h[0] -eq 0xEF) -and (`$h[1] -eq 0xBB) -and (`$h[2] -eq 0xBF)) { `$h = `$h[3..(`$h.Length-1)]; }
+return `$encoding.GetString(`$h).TrimEnd([Char] 0);
}
"@