anongist demo (windows/ps1)

demo.ps1

# anongist encrypted runner (windows). AES-256-CBC/PBKDF2.
# Usage: irm <gist-raw-url> | iex
$Payload = 'U2FsdGVkX18GGE2pqFH6xbLxG/cYTDdmV9ZZouyqeMX3uxKon05FIa3bKLNPXiCBa0HEoEQnyEOfjIGVyHuy7v/8QFB8DdjuTfdj7waWnIkIYE4rOXpTtp6X10eD7/8bdET63Wwpq8CRpw8cmh461wCYqp+9KYiSP7CqsaeulYNGa4XGHLKmliDA+kt9Nc6NNvsOlfTf0pubSqlpfJT9U8f5UNvNcfmdTsJ4AseiNWv0fMu9n5xfAs5BCyoN1ZL9flh3GI7gtG+otaFUKvGuKh9AwcYMf4shJei9rkTJSLkO+YOFbBfCiCtszuhwCPCiaGq+yelQ6hChRo9t1r6+aQ=='

$sec  = Read-Host -AsSecureString "Password"
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec)
$Pass = [Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)

try {
    $raw = [Convert]::FromBase64String($Payload)
    if ([Text.Encoding]::ASCII.GetString($raw, 0, 8) -ne 'Salted__') { throw 'bad header' }
    # Array.Copy keeps these as [byte[]]; slicing would yield [object[]].
    $salt = New-Object 'byte[]' 8
    [Array]::Copy($raw, 8, $salt, 0, 8)
    $cipher = New-Object 'byte[]' ($raw.Length - 16)
    [Array]::Copy($raw, 16, $cipher, 0, $cipher.Length)

    $kdf = New-Object System.Security.Cryptography.Rfc2898DeriveBytes(
        $Pass, $salt, 10000, [System.Security.Cryptography.HashAlgorithmName]::SHA256)
    $key = $kdf.GetBytes(32)
    $iv  = $kdf.GetBytes(16)

    $aes = [System.Security.Cryptography.Aes]::Create()
    $aes.Key = $key; $aes.IV = $iv
    $aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
    $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

    $dec   = $aes.CreateDecryptor()
    $plain = $dec.TransformFinalBlock($cipher, 0, $cipher.Length)
    $code  = [Text.Encoding]::UTF8.GetString($plain)
}
catch {
    Write-Error 'anongist: decryption failed (wrong password or corrupted payload)'
    exit 1
}

Invoke-Expression $code