{"id":2269,"date":"2016-09-15T00:11:53","date_gmt":"2016-09-14T22:11:53","guid":{"rendered":"https:\/\/www.asafety.fr\/?page_id=2269"},"modified":"2016-09-15T00:25:17","modified_gmt":"2016-09-14T22:25:17","slug":"exe2powershell","status":"publish","type":"page","link":"https:\/\/www.asafety.fr\/en\/projects\/exe2powershell\/","title":{"rendered":"exe2powershell"},"content":{"rendered":"<p><\/p>\n<p style=\"text-align: center;\"><strong>exe2powershell &#8211; exe2bat reborn for modern Windows<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/exe2powershell\" target=\"_blank\"><strong>Download exe2powershell<\/strong><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/exe2powershell\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2245\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/githubbutton.png\" alt=\"githubbutton\" width=\"230\" height=\"70\" \/><\/a><\/p>\n<p>exe2bat reborn in <strong>exe2powershell<\/strong> for modern Windows. Initial author ninar1, based on riftor work, and modernized by ycam exe2powershell.<\/p>\n<p><strong>exe2powershell<\/strong> is used to convert any binary file (*.exe) to a BAT file.<br \/>\nThe resulting BAT file contains only &#8220;echo&#8221; command and finally a powershell command to re-create the original binary file.<\/p>\n<p>This kind of tool is usefull during pentesting when an auditor triggers a shell without any upload feature. With only &#8220;echo&#8221; and &#8220;powershell&#8221; commands the auditor is able to &#8220;upload&#8221; any binary file on the targeted system.<\/p>\n<ul>\n<li>Main code taken from Riftors &#8220;exe2hex&#8221;.<\/li>\n<li>Adapted for Windows BAT file by ninar1.<\/li>\n<li>Modernized to newer Windows systems by Yann CAM<\/li>\n<\/ul>\n<p>This version is modernized from exe2bat to work with modern Windows version. exe2bat have limitation :<\/p>\n<ul>\n<li>Need &#8220;debug.exe&#8221; available on the target computer (16-bit application removed on Windows 7 x64 but available on Windows 7 x86)<\/li>\n<li>Limit input exe to 64kB<\/li>\n<\/ul>\n<p><strong>exe2powershell<\/strong> replace the need of &#8220;debug.exe&#8221; by a PowerShell command line available on all Windows since Windows 7 \/ 2008. There is no more limitation in input exe size.<\/p>\n<h1>How to use :<\/h1>\n<pre>C:<span class=\"pl-cce\">\\e<\/span>xe2powershell<span class=\"pl-cce\">\\b<\/span>in<span class=\"pl-k\">&gt;<\/span>exe2powershell.exe\r\n  ______          ___  _____                       _____ _          _ _\r\n <span class=\"pl-k\">|<\/span>  ____<span class=\"pl-k\">|<\/span>        <span class=\"pl-k\">|<\/span>__ <span class=\"pl-cce\">\\|<\/span>  __ <span class=\"pl-cce\">\\ <\/span>                    \/ ____<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>        <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>\r\n <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>__  __  _____   ) <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>__) <span class=\"pl-k\">|<\/span>____      _____ _ _<span class=\"pl-k\">|<\/span> (___ <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>__   ___<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>\r\n <span class=\"pl-k\">|<\/span>  __<span class=\"pl-k\">|<\/span> <span class=\"pl-cce\">\\ \\\/<\/span> \/ _ <span class=\"pl-cce\">\\ <\/span>\/ \/<span class=\"pl-k\">|<\/span>  ___\/ _ <span class=\"pl-cce\">\\ \\ <\/span>\/<span class=\"pl-cce\">\\ <\/span>\/ \/ _ <span class=\"pl-cce\">\\ <\/span><span class=\"pl-s\"><span class=\"pl-pds\">'<\/span>__\\___ \\| <span class=\"pl-pds\">'<\/span><\/span>_ <span class=\"pl-cce\">\\ <\/span>\/ _ <span class=\"pl-cce\">\\ <\/span><span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>\r\n <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>____ <span class=\"pl-k\">&gt;<\/span>  <span class=\"pl-k\">&lt;<\/span>  __\/\/ \/_<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>  <span class=\"pl-k\">|<\/span> (_) <span class=\"pl-cce\">\\ <\/span>V  V \/  __\/ <span class=\"pl-k\">|<\/span>  ____) <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>  __\/ <span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>\r\n <span class=\"pl-k\">|<\/span>______\/_\/<span class=\"pl-cce\">\\_\\_<\/span>__<span class=\"pl-k\">|<\/span>____<span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span>   <span class=\"pl-cce\">\\_<\/span>__\/ <span class=\"pl-cce\">\\_<\/span>\/<span class=\"pl-cce\">\\_<\/span>\/ <span class=\"pl-cce\">\\_<\/span>__<span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>_____\/<span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span> <span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span><span class=\"pl-cce\">\\_<\/span>__<span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span>_<span class=\"pl-k\">|<\/span>\r\n\r\n        [ exe2bat reborn <span class=\"pl-k\">in<\/span> exe2powershell <span class=\"pl-k\">for<\/span> modern Windows ]\r\n [ initial author ninar1, based on riftor work, and modernized by ycam ]\r\n [ exe2powershell version 1.0 - keep up2date: asafety.fr \/ synetis.com ]\r\n\r\n [<span class=\"pl-k\">*<\/span>] Usage <span class=\"pl-c1\">:<\/span> exe2powershell.exe inputfile outputfile\r\n [<span class=\"pl-k\">*<\/span>] e.g.  <span class=\"pl-c1\">:<\/span> exe2powershell.exe nc.exe nc.bat<\/pre>\n<h1>How to upload binary file via command line?<\/h1>\n<p>Detailed <a href=\"https:\/\/www.asafety.fr\/vuln-exploit-poc\/windows-dos-powershell-upload-de-fichier-en-ligne-de-commande-one-liner\/\" target=\"_blank\">blog post here<\/a>.<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/exe2powershell\" target=\"_blank\"><strong>Download exe2powershell<\/strong><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/github.com\/yanncam\/exe2powershell\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2245\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/githubbutton.png\" alt=\"githubbutton\" width=\"230\" height=\"70\" \/><\/a><\/p>\n<p><\/p>","protected":false},"excerpt":{"rendered":"<p>exe2powershell &#8211; exe2bat reborn for modern Windows Download exe2powershell exe2bat reborn in exe2powershell for modern Windows. Initial author ninar1, based [&hellip;]<\/p>\n","protected":false},"author":1337,"featured_media":0,"parent":13,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-2269","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/2269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=2269"}],"version-history":[{"count":5,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/2269\/revisions"}],"predecessor-version":[{"id":2275,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/2269\/revisions\/2275"}],"up":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/pages\/13"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=2269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}