hanshaze Posted May 5, 2017 Share Posted May 5, 2017 Can someone tell me what I have to make so I can read the output of my decoding? That would be cool.......;-P Quote Link to comment Share on other sites More sharing options...
b0N3z Posted May 5, 2017 Share Posted May 5, 2017 Have you tried to use a web based decoder to see if its the module itself? Quote Link to comment Share on other sites More sharing options...
TheDoubleD Posted May 6, 2017 Share Posted May 6, 2017 It looks like you have a null byte between each character. Each character is two bytes. You can copy and paste to an editor and you should be able to read. If not and you are on Linux you can save to a file and run strings on it from a shell. Quote Link to comment Share on other sites More sharing options...
PoSHMagiC0de Posted May 6, 2017 Share Posted May 6, 2017 (edited) That is a unicode base64 encoding. Did someone try and send you a powershell launcher? In Linux I do not know the procedure but you will have to decode from base 64 to byte and remove the null after each character. In windows in powershell 4 and higher you just do this: $encoded = "the base64string" #Put base64 into variable. $encbytes = [convert]::frombase64string($encoded) #convert to byte array $decodedstr = [encoding]::unicode.getstring($encbytes) #convrt to string using unicode $decodestr #display string in terminal As long as you do not run it you will be fine meaning don't put "iex" or "&" in front of that variable. If you have Powershell version 6 alpha installed in Linux then the above will work also in a Powershell terminal. Just figured out in other language than Powershell. Just loop through the string or byte array...or buffer and pull first byte/char, skip the next and then pull the one after that. In python you can create a loop to skip every second character/byte. Edited May 6, 2017 by PoSHMagiC0de Figured out a way in other lang. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.