So we have found the base64 string “SGVsbG9Xb3JsZCE=” on a locked down workstation and we want to decode. Quite often we don’t have access to tools so here’s a list of ways to decode the string using various languages.
Python
12>>> import base64 >>> base64.b64decode("SGVsbG9Xb3JsZCE=")PowerShell
12PS > [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SGVsbG9Xb3JsZCE=")) blahblahPerl
12use MIME::Base64; print decode_base64("SGVsbG9Xb3JsZCE=");BASH
1echo SGVsbG9Xb3JsZCE= | base64 --decodephp
1echo base64_decode("SGVsbG9Xb3JsZCE=");C#
12byte[] data = Convert.FromBase64String("SGVsbG9Xb3JsZCE=");… Continue reading
First off, credit for this work goes to n3k @kiqueNissim and X_Typhon @lintuxt who produced an excellent paper here.
These notes are not to take anything away from the two mentioned above but are purely for my own reference (I find writing things up helps me to remember it), I strongly suggest reading the white paper as it goes into much more detail than I will here.
So on… Continue reading