Skip to content

Instantly share code, notes, and snippets.

@duzvik
Forked from Karneades/ps-decody.py
Created May 24, 2021 09:31
Show Gist options
  • Save duzvik/9b4d3ca3ea1564c63eb2c87a1aafe0a4 to your computer and use it in GitHub Desktop.
Save duzvik/9b4d3ca3ea1564c63eb2c87a1aafe0a4 to your computer and use it in GitHub Desktop.
Simple python script to decode encoded PowerShell commands
# Karneades (2019)
# CyberChef recipe: https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Remove_null_bytes()
import sys
from base64 import b64encode,b64decode
if len(sys.argv) < 2:
print ("Usage: python3 ps-decode.py <encodedCommand>")
sys.exit(-1)
encodedCommand = sys.argv[1]
try:
print (b64decode(encodedCommand).decode('UTF-16LE'))
except Exception as e:
print (str(e))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment