lib/rex/powershell/output.rb
#
# Reverse the compression process
# Try gzip, inflate if that fails
#
# @return [String] Decompressed powershell code
Reverse the compression process
Try gzip, inflate if that fails
Reverse the compression process Try gzip inflate if that fails
def decompress_code
      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
      unencoded = Rex::Text.decode_base64(encoded_stream)
      begin
        @code = Rex::Text.ungzip(unencoded) || Rex::Text.zlib_inflate(unencoded)
      rescue Zlib::GzipFile::Error
        begin
          @code = Rex::Text.zlib_inflate(unencoded)
        rescue Zlib::DataError => e
          raise RuntimeError, 'Invalid compression'
        end
      end
      @code
    end
def decompress_code encoded_stream = @code . scan ( / FromBase64String \( '(.*)' / ) . flatten . first unencoded = Rex :: Text . decode_base64 ( encoded_stream ) begin @code = Rex :: Text . ungzip ( unencoded ) || Rex :: Text . zlib_inflate ( unencoded ) rescue Zlib :: GzipFile :: Error begin @code = Rex :: Text . zlib_inflate ( unencoded ) rescue Zlib :: DataError => e raise RuntimeError , 'Invalid compression' end end @code end
Reverse the compression process
Try gzip, inflate if that fails
Reverse the compression process Try gzip inflate if that fails
# Extract substring with payload # Decode and decompress the string
Decompressed powershell code
Decompressed powershell code
String