Deobfuscate PowerShell using MinusOne

Obfuscated PowerShell is everywhere – this post shows how the Reverse Shell Generator produces randomized scripts and how MinusOne deobfuscates them in seconds.

It generates a different PowerShell variant every time you click Generate.

But here’s the fix 👇

MinusOne – Powershell Deobfuscator – written in Rust by AirbusCERT – cleans it up in seconds

What does it do?

• It’s an obfuscated PowerShell TCP reverse shell.
• It creates a System.Net.Sockets.TCPClient to <input ip>:<input port>and reads bytes from the stream
• It decodes bytes to text with System.Text.ASCIIEncoding, executes via Invoke-Expression.
• It then returns output plus a fake PS <cwd> > prompt using ASCII.GetBytes() and Write()

• MinusOne – Powershell Deobfuscator
• GitHub – airbus-cert/minusone: Powershell Linter