CharlieC3
8/12/2016 - 2:53 PM

Deobfuscate Password for Powershell scripts

Deobfuscate Password for Powershell scripts

# Assuming a 128-bit (16 Byte) key was used to encrypt it and we know the key...
[Byte[]] $key = (1..16)

# $obfPW obtained from obfuscate_password.ps1 script, injected in this case
$obfPW = '76492d1116743f0423413b16050a5345MgB8AEUASQBwAHgANwBqAEQAUABYAGsAcgBqAFAAYwA0AEMAbwBxAGwAbABLAHcAPQA9AHwAMwBiAGQAYQBlADMAMQA5ADQANQAwAGIAMQBkAGUANgA2ADYAOQBjAGYAMgBiAGUAMABiADMAYQA3ADAANgBhAGEANQBjADUANgBlAGIAMQBiADIAYwA1AGIANgA3ADcAYwAyADEANgAzADUAOAA1ADAAZQA0ADQAMAA4AGEAMQA='

# Convert it to a Secure String using the key
$secPW = $obfPW | ConvertTo-SecureString -Key $key

# Create a new credential object
$credential = New-Object System.Management.Automation.PSCredential (“test”, $secPW)

# Print password in plain text
$credential.GetNetworkCredential().password