Skip to content

Instantly share code, notes, and snippets.

@Karneades
Last active May 24, 2021 09:31
Show Gist options
  • Save Karneades/38cce20ca960da821c7b091c9d9f93fa to your computer and use it in GitHub Desktop.
Save Karneades/38cce20ca960da821c7b091c9d9f93fa to your computer and use it in GitHub Desktop.
Simple python script to decode encoded PowerShell commands
# Karneades (2019)
# CyberChef recipe: https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Remove_null_bytes()
import sys
from base64 import b64encode,b64decode
if len(sys.argv) < 2:
print ("Usage: python3 ps-decode.py <encodedCommand>")
sys.exit(-1)
encodedCommand = sys.argv[1]
try:
print (b64decode(encodedCommand).decode('UTF-16LE'))
except Exception as e:
print (str(e))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment