Changeset 5556

Timestamp:

07/14/08 13:57:13 (3 months ago)

Author:

egypt

Message:

add string obfuscation

Files:

• framework3/trunk/lib/rex/exploitation/obfuscatejs.rb (modified) (5 diffs)

framework3/trunk/lib/rex/exploitation/obfuscatejs.rb

@@ -8 +8 @@
-
-        #
-
-
+
+
+
+
+
+
+
-        #
-        # {
@@ -23 +28 @@
-        # joeBob before joe because it is more specific and will be globally
-        # replaced before joe is replaced.
+        #
+        # A simple example follows:
+        #
+        # <code>
+        # js = ObfuscateJS.new <<ENDJS
+        #     function say_hi() {
+        #         var foo = "Hello, world";
+        #         document.writeln(foo);
+        #     }
+        # ENDJS
+        # js.obfuscate(
+        #     'Symbols' => { 
+        #              'Variables' => [ 'foo' ],
+        #              'Methods'   => [ 'say_hi' ] 
+        #         }
+        #     'Strings' => true
+        # )
+        # </code>
+        #
+        # which should generate something like the following:
+        #
+        # <code>
+        # function oJaDYRzFOyJVQCOHk() { var cLprVG = "\x48\x65\x6c\x6c\x6f\x2c\x20\x77\x6f\x72\x6c\x64"; document.writeln(cLprVG); }
+        # </code>
-        #
-        def self.obfuscate(js, opts = {})
@@ -50 +79 @@
-                remove_comments
-
+                if opts['Strings']
+                        obfuscate_strings()
+
+                        # Normal space randomization does not work for
+                        # javascript -- despite claims that space is irrelavent,
+                        # newlines break things.  Instead, use only space (0x20)
+                        # and tab (0x09).
+
+                        @js = Rex::Text.compress(@js)
+                        @js.gsub!(/\s+/) { |s|
+                                len = rand(50)+2
+                                set = "\x09\x20"
+                                buf = ''
+                                while (buf.length < len)
+                                        buf << set[rand(set.length)].chr
+                                end
+                                
+                                buf
+                        }
+                end
-                # Globally replace symbols
-                replace_symbols(opts['Symbols']) if opts['Symbols']
@@ -62 +111 @@
-                @js
-        end
+        alias :to_str :to_s
-
-protected
-
-
+
+
+
+
+
+
-        def remove_comments
-
+
+
-        end
-
@@ -99 +155 @@
-        end
-
+        #
+        # Change each string into some javascript that will generate that string
+        #
+        # This tries to deal with escaped quotes within strings but
+        # won't catch things like 
+        #     "\\"
+        # so be careful.
+        #
+        def obfuscate_strings()
+                @js.gsub!(/".*?[^\\]"|'.*?[^\\]'/) { |str|
+                        str = str[1, str.length-2]
+                        case (rand(3))
+                        when 0
+                                buf = '"' + Rex::Text.to_hex(str) + '"'
+                        when 1
+                                 buf = "unescape(\"" + Rex::Text.to_hex(str, "%") + "\")" 
+                        when 2
+                                buf = "String.fromCharCode(" 
+                                str.each_byte { |c| 
+                                        if (0 == rand(2))
+                                                buf << " %i,"%(c)
+                                        else
+                                                buf << " 0x%0.2x,"%(c) 
+                                        end
+                                }
+                                buf = buf[0,buf.length-1] + " )" 
+                        end
+                        buf
+                }
+                @js
+        end
-
-end