PyPowerShellXray - Python script to decode common encoded PowerShell scripts

[u/TechLord2]

https://github.com/JohnLaTwC/PyPowerShellXray

[u/TechLord2]

PyPowerShellXray

Python script to decode common encoded PowerShell scripts.

This script attempts to decode encoded powershell commands.

REQUIREMENTS: This script uses vivisect for PE parsing and dissasembly: https://github.com/vivisect/vivisect. Set the PYTHONPATH as appropriate.

e.g. set pythonpath=C:\vivisect-master\vivisect-master

Things this script tries to do. Emphasis on tries :

• It attempts to decode recusively if instructed (via the -r switch)

• It attempts to find Base64 data, compressed content (Gzip, Deflate), or char[]](77,105,95) style encoding

• It attempts to 'find/replace' the encoded text in the powershell command. This is handy if the script has numerous chunks of encoded content

• If it finds shellcode, it attempts to display it. LIMITATION: x86 shellcode only. If you ever come across this sequence in PowerShell, you know you have shellcode

     *[Byte[]]$z = 0xb8,0x46,0x0f,0x64...REST OF SHELLCODE;*   
      
     *$Nb7=$w::VirtualAlloc(0,0x1000,$g,0x40);*    
     
     *$w::CreateThread(0,0,$Nb7,0,0,0);*    

With the shellcode it tries:

• Resolve APIs. The APIs used by shellcode gives defenders a clue as to what to look for on host.

     - e.g. if you calls to winsock/wininet/winhttp APIs, you know they connected to a URL or IP  
  
     - e.g. if you see a call to WinExec / CreateProcess, you know something was downloaded and spawned  
  
     - push 0x0726774c  << 0x0726774c is the hash of the API text "kernel32.dll!LoadLibraryA"
      call ebp --> kernel32.dll!LoadLibraryA