offensive security
Encode/Decode Data with Certutil
Defense Evasion
In this lab I will transfer a base64 encoded php reverse shell from my attacking machine to the victim machine via netcat and decode the data on the victim system using a native windows binary
certutil.Execution
Preview of the content to be encoded on the attacking system:
Sending the above shell as a base64 encoded string to the victim system (victim is listening and waiting for the file with
nc -l 4444 > enc):Once the file is received on the victim, let's check its contents:
Let's decode the data:
Let's have a look at the contents of the file
dec which now contains the base64 decoded shell:
References
Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®
Last modified 3yr ago
Copy link