@@ -265,7 +265,7 @@ the output of your payload back. :P
265
265
}
266
266
267
267
$PowerShellPath = $Result.sValue
268
- Write-Verbose " Full PowerShell path: $PowerShellPath "
268
+ Write-Verbose " [ $Computer ] Full PowerShell path: $PowerShellPath "
269
269
270
270
$EncodedPayload = [Convert ]::ToBase64String([Text.Encoding ]::Unicode.GetBytes($Payload ))
271
271
@@ -296,11 +296,18 @@ the output of your payload back. :P
296
296
if (($Result.ReturnValue -eq 0 ) -and ($Result.sValue )) {
297
297
$Payload = [Text.Encoding ]::Unicode.GetString([Convert ]::FromBase64String($Result.sValue ))
298
298
299
- $SerilizedPayloadResult = Invoke-Expression ($Payload ) | % {
300
- [Management.Automation.PSSerializer ]::Serialize($_ , 4 )
301
- }
299
+ $TempSerializedResultPath = [IO.Path ]::GetTempFileName()
300
+
301
+ $PayloadResult = Invoke-Expression ($Payload )
302
+
303
+ Export-Clixml - InputObject $PayloadResult - Path $TempSerializedResultPath
304
+
305
+ $SerilizedPayloadText = [IO.File ]::ReadAllText($TempSerializedResultPath )
306
+
307
+ $null = Invoke-WmiMethod @WmiMethodArgs - Name ' SetStringValue' - ArgumentList $Hive , $RegistryKeyPath , $SerilizedPayloadText , $RegistryResultValueName
308
+
309
+ Remove-Item - Path $SerilizedPayloadResult - Force
302
310
303
- $null = Invoke-WmiMethod @WmiMethodArgs - Name ' SetStringValue' - ArgumentList $Hive , $RegistryKeyPath , $SerilizedPayloadResult , $RegistryResultValueName
304
311
$null = Invoke-WmiMethod @WmiMethodArgs - Name ' DeleteValue' - ArgumentList $Hive , $RegistryKeyPath , $RegistryPayloadValueName
305
312
}
306
313
}
@@ -329,7 +336,13 @@ the output of your payload back. :P
329
336
Write-Verbose " [$Computer ] Payload results successfully retrieved from: $RegistryHive \$RegistryKeyPath \$RegistryResultValueName "
330
337
331
338
$SerilizedPayloadResult = $Result.sValue
332
- $PayloadResult = [Management.Automation.PSSerializer ]::Deserialize($SerilizedPayloadResult )
339
+
340
+ $TempSerializedResultPath = [IO.Path ]::GetTempFileName()
341
+
342
+ Out-File - InputObject $SerilizedPayloadResult - FilePath $TempSerializedResultPath
343
+ $PayloadResult = Import-Clixml - Path $TempSerializedResultPath
344
+
345
+ Remove-Item - Path $TempSerializedResultPath
333
346
334
347
$FinalResult = New-Object PSObject - Property @ {
335
348
PSComputerName = $Computer
0 commit comments