MScholtes/TechNet-Gallery

ps2exe creating file with GetStream from TcpClient fails

Ajoro opened this issue · 1 comments

Ajoro commented

Creating an exe from a ps1 file that calls GetStream from TcpClient throws the following error:

>powershell.exe -command "&'.\ps2exe.ps1' ./getstreamerror.ps1"
PS2EXE-GUI v0.5.0.24 by Ingo Karstein, reworked and GUI support by Markus Scholtes

You are using PowerShell 4.0 or above.

Reading input file C:\Users\Ajoro\Ps2exe\PS2EXE-GUI\getstreamerror.ps1
C:\Users\Ajoro\Ps2exe\PS2EXE-GUI\ps2exe.ps1 : Missing closing '}' in statement block or type definition.
At line:1 char:1
+ &'.\ps2exe.ps1' ./getstreamerror.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString,ps2exe.ps1

Steps to reproduce:

Try to convert the following to a exe
(New-Object System.Net.Sockets.TcpClient).GetStream()

Or:

$tcpclient = New-Object System.Net.Sockets.TcpClient
$tcpclient.Connect("localhost", 9000)
$stream = $tcpclient.GetStream()

Hello,

this is an easy malware check. When I first noticed that anti virus tools detected PS2EXE generated executables as malware, I contacted the vendors of this tools to tell them that this is false positive. Some told me that it is NOT a false positive since there is a proof of concept of malware on the internet. So my intention of this "malware check" was to achieve that the POC no longer works. Of course only Script Kiddies are prevented from circumventing this check. But for my argumentation it is very important that the POC malware cannot be created with the current version of the program.

Greetings

Markus