0

When I execute this command:

PS C:\> PowerShell -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMwA3ADMAMQAzADkAMQAxAC4AOAA5ADMAOQA4ADYANwAtADQANAAyADIANQA0ADYAMAA1ADAANwA0ADQAJwAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHQAbQBwAC4ARgB1AGwAbABOAGEAbQBlAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

An error occurred while creating the pipeline.
    + CategoryInfo          : NotSpecified: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : RuntimeException

Powershell version (Windows 10 Pro with latest updates):

> $PSVersionTable.PSVersion

Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      19041  1320

I have to mention that this command is executed by Ansible through SSH, but even if I execute the command directly in Powershell terminal, it throws the same error. The command is Base64 encoded, the decoded command is:

Set-StrictMode -Version Latest
$tmp_path = [System.Environment]::ExpandEnvironmentVariables('%TEMP%')
$tmp = New-Item -Type Directory -Path $tmp_path -Name 'ansible-tmp-1637313911.8939867-4422546050744'
Write-Output -InputObject $tmp.FullName
If (-not $?) { If (Get-Variable LASTEXITCODE -ErrorAction SilentlyContinue) { exit $LASTEXITCODE } Else { exit 1 } }

If I execute the command line by line then is working.
On an another Windows box with older version of Powershell it is working. The Powershell version on the machine (Windows Server 2016) where is working is:

PS C:\Users\Administrator> $PSVersionTable.PSVersion

Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      14393  693

Please give me some hints what to do to fix this issue, or an workaround...

Zeitounator
  • 38,476
  • 7
  • 53
  • 66
Getodac
  • 119
  • 7
  • 1
    First it runs on my windows 10 (Powershell Build 19041). Second do you take care to run it in an elevated shell ? – JPBlanc Nov 19 '21 at 11:14
  • In an elevated shell I got the same error. – Getodac Nov 19 '21 at 12:22
  • 1
    Please remove SilentlyContinue ErrorAction flag so there could be the error description. – Kirill Pashkov Nov 19 '21 at 14:21
  • I removed "-ErrorAction SilentlyContinue", exactly the same behaviour. – Getodac Nov 19 '21 at 14:37
  • Mmm, encoded piece manually works on my Windows10 - did you clean up the files after running it manually? – Mike Nov 19 '21 at 16:31
  • Yes I did. The same thing. Maybe it is related to the some security policies configured by our IT department? – Getodac Nov 22 '21 at 09:10
  • It is caused by Cisco Secure Endpoint Antivirus. Probably it thinks that the script is malicious. – Getodac Jan 17 '22 at 18:01
  • Longer command lines tend to cause this error. For example: echo ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE12345ABCDE – Victor Olex Mar 17 '22 at 21:49

0 Answers0