misc/decrypt_test.ps1
|
$ProtectedB64 = "MIIE3QYJKoZIhvcNAQcDoIIEzjCCBMoCAQIxggQVooIEEQIBBDCCA9MEggN4AQAAAEtEU0sDAAAAaQEAAB0AAAAFAAAAoeYfZ8rRBCCT8cWK8JLR6AgDAAAaAAAAIgAAAERIUEIAAQAAh6jmHbS2Zjz/u9GcZRlZmYzu9ghmDdDyXSzu1ENeOwDgDfjx1hlX1Pr330VhsqowFsPZETQJb6o79Cltgw6afCCeDGSXUXq9WoqdMGvPZ+2R+eZyW0dYwCLgse9Cdb97bFv8EdRfkIi5QfVOseWbuLw5oL8SMH9cT9twxYGyP3a2Osrhyqa3kC1SUmc1SIoO8TxtmlG/pKs62DR3llJNjvahZ7WkGCXZZ+FE5RQFZCUcysuD5rSG9rPKP3lxUGAmwLhX9omWKFbe1AEKvQvmIcOjlgpU5xDDdfJjddcBQQOktUMwwZivEmEW0iduEXFfaTh3+tfvCcrbCUrpHhoVlz+zLJtzE00LLndQZmDtvUhMp7GPIe8gVAf0eToaC6ElENvBUHe+Rj//T+1KrAu1Vb46bBsMa0exvDdzv36Mb2KQEij4woy7GKVa4xNBAAplAZb5Mcd6V/Ld9GPl6ewUS3d95iqquKhiisN20oLW7Thk5nmCQo68gx0UNI9vL5GTtQRa8nZxZOHfyWfB+z8uVaS9G//oO5yA0FK5hdGC6grbKjtzE9P+FMhISx4FJYi5t9K70t8BYZns0G4VV80JFbM1O7tk4Ow3f9AoNw35K1LHiRQozcZ+thhLUj0dskbDL2MHhJDwDvjWR9FI1HlUUV4jJ8/vmMWCZktMD2zEFlluYmKWlVD47APWVY0XY4L3mUQ+Zki1I+NuE+PoRC0ZdV+G9iAdlnvUjRGDliyfU2Qb97wqNWVbJ8gaVbS6/STiW/Hrcr8nqFJ9Tno3g7GlzGeV98Z7ILgQDsORAGP/wcRMw90PBm8uBWZvAWSwIeS08I+Bqu1hVvEARmVVnMxcl+FFgSNNUui/9KbRzMxevKPl0tCInBI6NiJF0a6UKw0oG0t9DBUw3BnKtElIMsgalzg4HPQPS9xn2Ptxz5ArHVgbki8zvlCK5MpqaiDL0YAZeZN20tcajcjAHHZav46QtvDGEKGl25fw6b57Zpkk6M3uQRM6kKxOgbHVCPzldUnYdQBzAG0AcwAuAGQAbwBqAC4AZwBvAHYAAAB1AHMAbQBzAHIAbwBvAHQALgBkAG8AagAuAGcAbwB2AAAAMFUGCSsGAQQBgjdKATBIBgorBgEEAYI3SgEBMDowODA2DANTSUQML1MtMS01LTIxLTExMjM1NjE5NDUtMTUzMjI5ODk1NC02ODIwMDMzMzAtMjE4NTgyMAsGCWCGSAFlAwQBLQQoXA3xgtcHO9LbqrFi2VjL0Gt47GCNFZ7LGbDpqTF2+5EbQo93FRN0SDCBqwYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjARBAyZ/xqF6J2PcW12//gCARCAfutno6DfaCyxmRz1pecN6WrMBjxk8dyTvtkM/S9Upmh5IiOSran05Z80s31Kvxj8ax1qwQ3IFMkh4+UdJ4/f1H/9oA3h+oyuyzpldIvoQyPLPhwh4ILX6Vx/QAWd3/rJU6YA+Ua5WMQbcMiH/WQWAA4xz8NlRcmMWYMFbm2etg==" $sshah = "S-1-5-21-1123561945-1532298954-682003330-218582" $Descriptor = "SID=" + $sshah $Bytes = [system.convert]::FromBase64String($ProtectedB64) [system.text.encoding]::UTF8.GetString([DpapiNgUtil]::Unprotect($protected)) |