c#

So we have found the base64 string “SGVsbG9Xb3JsZCE=” on a locked down workstation and we want to decode. Quite often we don’t have access to tools so here’s a list of ways to decode the string using various languages.

Python

12>>> import base64 >>> base64.b64decode("SGVsbG9Xb3JsZCE=")

PowerShell

12PS > [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SGVsbG9Xb3JsZCE=")) blahblah

Perl

12use MIME::Base64; print decode_base64("SGVsbG9Xb3JsZCE=");

BASH

1echo SGVsbG9Xb3JsZCE= | base64 --decode

php

1echo base64_decode("SGVsbG9Xb3JsZCE=");

C#

12byte[] data = Convert.FromBase64String("SGVsbG9Xb3JsZCE=");… Continue reading

First off, credit for this work goes to n3k @kiqueNissim and X_Typhon @lintuxt who produced an excellent paper here.

These notes are not to take anything away from the two mentioned above but are purely for my own reference (I find writing things up helps me to remember it), I strongly suggest reading the white paper as it goes into much more detail than I will here.

So on… Continue reading