PowerShell Obfuscation Layers | Whitehat Security

Back to Challenges

Malware Analysis

Code Write

Advanced (4/5)

Premium

PowerShell Obfuscation Layers

Review the challenge brief, files, and requirements.

Open Proving Grounds

Challenge Brief

A malicious PowerShell script uses multiple obfuscation layers. Deobfuscate it.

Obfuscated Script

$a = [char]105 + [char]69 + [char]88  # Builds "iEX"
$b = 'JGM9W1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGODo6R2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoIlpteEFaM3RqYjI1allYUmZjM1J5YVc1bmZRPT0iKSk='
$d = [System.Text.Encoding]::UTF8::GetString([System.Convert]::FromBase64String($b))
& ([scriptblock]::Create("$a $d"))

Write code to strip away each obfuscation layer and reveal the final payload.

Sign in to attempt this challenge.

Challenge Info

Points85

Time limit10 min

Minimum rankSPECIALIST

AccessPremium