danielbohannon / Invoke-Obfuscation

PowerShell Obfuscator
Apache License 2.0
3.7k stars 765 forks source link

String Token obfuscation breaks multiline string variable substitution #46

Open lehoffma opened 5 years ago

lehoffma commented 5 years ago

If you apply any of the string obfuscations on a multiline string with a variable substitution, the variable will be treated as a normal part of the string and thus won't be substituted.

Example script:

$script = "hello"

$ps = @"
$script
"@

Write-Output $ps;

After applying the Token\String\2 obfuscation on it:

$script = ("{1}{0}" -f 'o','hell')

$ps = ((('Cd'+'H
'+'
TR'+'Cs'+'cri'+'pt
CdH') -RePLACE ([ChaR]84+[ChaR]82+[ChaR]67),[ChaR]36 -RePLACE 'CdH',[ChaR]34))

Write-Output $ps;

Calling the obfuscated script results in this being printed:

"
$script
"

instead of hello.

As far as I know there is currently no way to obfuscate this script correctly, without just abandoning the script obfuscation entirely. I'm using version 1.8, by the way.