powershell 解码Labtech Agent EDF值

Posted 2021-05-22

function ConvertEDF {
param($Value)
    $suckurity = $Value
    $missleCodes = [byte[]](3, 44, 65, 12, 95, 123, 84, 240, 229, 167, 10, 154, 45, 89, 103, 219)
    $byteMe=[System.Convert]::FromBase64String($suckurity)
    For ($i=0; $i -le $byteMe.GetUpperBound(0); $i++) {$byteMe[$i]=[byte]$byteMe[$i] -bxor [byte]129}
    $NaCl=[System.Text.Encoding]::UTF8.GetString($byteMe,0,8)
    $r = new-object System.Security.Cryptography.RijndaelManaged
    $r.key=(new-Object Security.Cryptography.MD5CryptoServiceProvider).ComputeHash([Text.Encoding]::UTF8.GetBytes("Thank you for using LabTech.$NaCl"))
    $r.IV=$missleCodes
    $d=$r.CreateDecryptor()
    $ms = new-Object IO.MemoryStream @($byteMe,8,($byteMe.Length-8))
    $cs = new-Object Security.Cryptography.CryptoStream $ms,$d,"Read"
    $sr = new-Object IO.StreamReader $cs
    Write-Output $($sr.ReadToEnd())
    $sr.Close(); $cs.Close(); $ms.Close(); $r.Clear()
}
$ClientEDF = Get-Content $env:windir\LTSvc\ClientEdf.ini
$EncodedValue = ($ClientEDF | Where {$_ -like "ITGlue:*"}) -replace "ITGlue:",""

ConvertEDF -Value $EncodedValue