Welcome to the Obfuscation Games!

Challenge:

During a recent incident response investigation, we came across this suspicious command executed by an attacker, and we'd like you to analyze it. Malware authors like to obfuscate their payloads to make it harder, but we're sure you're up to the task. See if you can figure out what's happening without even running it!

$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAEFgjl8A/xXMMQrCQBCF4as8FltPIFaCnV3A8jFmn8ngupuYaUS8e5LyL77//vHQcWxLIHWj8Cw2wBd4RWyp2resjMm+pVlOJxzmGWekm8Iu3fU3ScXrwIf1L26C+4CtijukBY3hb/3TCj2Ieh9qAAAA"));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Solution:

This is a common pattern found in MS Office Document malware and contains data that is Gzipped, then Base64 encoded. It’s fairly simple to decode by dropping the string value within the FromBase64String() function into CyberChef with the From Base64 and Gunzip operations as a recipe:

The accepted flag was, MetaCTF{peeling_back_the_flag_one_code_at_a_time}