Encode a script or command to Base64 and pass it as parameter to PowerShell with EncodedCommand

In this post I will show you a cool tip allowing you to encode a script or command to Base64 then pass it as parameter to PowerShell using the -EncodedCommand parameter.

Context

- You have a PowerShell script or command to run on device

- You have a script containing many lines

- You don't want to have to send directly the script on the device

- You don't want this script to be stored on the device

- You don't want that everyone can read easily the script content

Encodedcommand ?

Two months ago I tweeted about this parameter -encode, now it's time for a blog post.

You can find this kind of switch for instance when you planify a reboot a device with PowerShell with basic shutdown /R command.

With process monitor you can find that thi will send it as encodedcommand, as below:

Be careful with this switch, that can be sometimes considered by hacking methods by your security team or can be detected like that by your antivirus.

Our example

In our example, we display a simple toast notification. The goal of this post is not a way to display toast but just an example to see how works the -encodedcommand switch.

See below the toast code:

See below the toast:

How it works ?

Convert script to base64

1. We will add the toast code in a string, as below:

2. We will convert the PowerShell code to Base64, as below:

3. This will give the below base64:

4. You can also store it in a variable

Add script as encoded command

1. We will use the switch -EncodedCommand then add our B64 code

5. Add this to Powershell, as below

Of course you can pass what you want.

You can play with Base64 Encode/Decode both using PowerShell or Web.

See here a cool website for playing with Base64.

See below the result of the website after decoding the Base64 part: