Obfuscation base64 with CMD

[MarineLeM]

The Base64 obfuscation works well with PowerShell and sh executors, but it does not seem to work with the cmd executor.

When I checked the code, I found that the functions responsible for obfuscating commands are implemented specifically for psh and sh, but not for cmd.
To further investigate, I analyzed the network traffic and observed the HTTP requests between Caldera and the agent. For PowerShell, the command was obfuscated

powershell -Enc ZQBjAGgAbwAgAGgAZQBsAGwAbwAgAHcAbwByAGwAZAA=

However, for cmd, the command was in plain text.

echo hello world

My questions are:

• Does the Base64 obfuscation feature support the cmd executor?
• If not, is it technically possible to implement Base64 obfuscation for cmd commands?

[github-actions]

Looks like your first issue -- we aim to respond to issues as quickly as possible. In the meantime, check out our documentation here: http://caldera.readthedocs.io/