The problem with the length of the firmware Encoderhell EncodedCommand

Question

I am trying to use powershell.exe -EncodedCommand parameter to run powershell script as another user. I do this so as not to run into difficulties with the command line when accelerating quotes and other special characters. I found that when the length of the encoded command exceeds 916 characters, it crashes with the following message:

Start-Process : This command cannot be run due to the error: The stub received bad data. 

Here is the code I'm using:

 $path = 'c:\temp' $UserName = '.\someuser' $Password = 'somepassword' $securePassword = ($Password | ConvertTo-SecureString -AsPlainText -Force) $credential = New-Object System.Management.Automation.PSCredential $UserName, $securePassword $command = {& .\Restore-DatabaseFromBackupFile.ps1 -DatabaseName 'aaaaaaaaaaaaaaa' -DatabaseBackupFilePath 'aaaaaaaaaaaaaaaaaaaaaaaaaaa' -DatabaseDataLogicalName 'aaaaaaaaaaaaaaa' -DatabaseLogLogicalName 'aaaaaaaaaaaaaaaaaaa' -DatabaseDataFilePath 'abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdef' -DatabaseLogFilePath 'a';Start-Sleep -Seconds 2} $commandBytes = [System.Text.Encoding]::Unicode.GetBytes($command) $encodedCommand = [Convert]::ToBase64String($commandBytes) Write-Warning $encodedCommand.Length Write-Warning $encodedCommand Start-Process -FilePath 'powershell.exe' -ArgumentList "-ExecutionPolicy Unrestricted -EncodedCommand $encodedCommand" -WorkingDirectory $path -LoadUserProfile -Credential $Credential DatabaseFromBackupFile.ps1 -DatabaseName 'aaaaaaaaaaaaaaa' -DatabaseBackupFilePath 'aaaaaaaaaaaaaaaaaaaaaaaaaaa' -DatabaseDataLogicalName 'aaaaaaaaaaaaaaa' -DatabaseLogLogicalName 'aaaaaaaaaaaaaaaaaaa' -DatabaseDataFilePath 'abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdef' -DatabaseLogFilePath 'a';. Start-Sleep -Seconds $path = 'c:\temp' $UserName = '.\someuser' $Password = 'somepassword' $securePassword = ($Password | ConvertTo-SecureString -AsPlainText -Force) $credential = New-Object System.Management.Automation.PSCredential $UserName, $securePassword $command = {& .\Restore-DatabaseFromBackupFile.ps1 -DatabaseName 'aaaaaaaaaaaaaaa' -DatabaseBackupFilePath 'aaaaaaaaaaaaaaaaaaaaaaaaaaa' -DatabaseDataLogicalName 'aaaaaaaaaaaaaaa' -DatabaseLogLogicalName 'aaaaaaaaaaaaaaaaaaa' -DatabaseDataFilePath 'abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdef' -DatabaseLogFilePath 'a';Start-Sleep -Seconds 2} $commandBytes = [System.Text.Encoding]::Unicode.GetBytes($command) $encodedCommand = [Convert]::ToBase64String($commandBytes) Write-Warning $encodedCommand.Length Write-Warning $encodedCommand Start-Process -FilePath 'powershell.exe' -ArgumentList "-ExecutionPolicy Unrestricted -EncodedCommand $encodedCommand" -WorkingDirectory $path -LoadUserProfile -Credential $Credential 

This code will not work. However, if you remove one character from any of the parameter values ​​(or somehow reduce the command in the script block), it will be executed successfully.

I found links to the 8190 character limit for cmd.exe on Windows XP and newer (this works on Windows Server 2012 R2), but I seem to be far from that limit.

Any ideas?

** UPDATE1: this behavior is affected by the -Credential parameter. If I remove the -Credential parameter and start as the current user, I was able to successfully execute the command when the length of the encoded command exceeds 19,000.

** UPDATE2: @Xalorous comments really solved the problem. Setting ExecutionPolicy to work around. I would be happy to give a loan if he / she publishes an answer.

Thanks!

Answer 1

Try -ExecutionPolicy Bypass instead of unlimited. Unlimited makes sense to set the policy of a machine or user, local or group object. This does not make sense for the command line.