Last active
March 30, 2016 16:48
-
-
Save keithmccammon/2f46c4db486d3311b647a07738aa79a4 to your computer and use it in GitHub Desktop.
Decode input passed to PowerShell's FromBase64String function
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| import gzip | |
| import base64 | |
| import StringIO | |
| import sys | |
| def gunzip(raw_data): | |
| decoded_data_obj = StringIO.StringIO(raw_data) | |
| decompressed_data_obj = gzip.GzipFile(fileobj=decoded_data_obj) | |
| return decompressed_data_obj.read() | |
| if __name__ == '__main__': | |
| raw_data = sys.argv[1] | |
| try: | |
| print gunzip(base64.b64decode(raw_data)) | |
| except IOError, err: | |
| if 'Not a gzipped file' in str(err): | |
| print base64.b64decode(raw_data) | |
| except TypeError, err: | |
| if 'Incorrect padding' in str(err): | |
| pad_delta = len(raw_data) % 4 | |
| if pad_delta == 0: | |
| print 'O NOES: A new edge case!' | |
| else: | |
| raw_data += '0' * pad_delta | |
| print base64.b64decode(raw_data) | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment