rex-exploitation 0.1.42 → 0.1.43

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6c3c655a61711289a496a809789adaedf0f252e96a3a60f30840627b3bc03cb
-  data.tar.gz: 91cdd049b97c784f989516329ba98c12252330dd2a4abce52cec0a5ae3cd9db4
+  metadata.gz: d57ee0a86e51281389fe57ae6bdef8d5a05973ddf9159ab084d61a494e9f525f
+  data.tar.gz: e77944b1b5b69f1fe584923a31005957af5f8e773f4c9335616fd288f1825524
 SHA512:
-  metadata.gz: e14c26a91cf648d4cabfea522a6cf9b871f30bb575bc482e8a06e153432dcd39c5153da72b92dd4b396516ca60e58c3006a988ab0e8ac1de98421d430de8f4c0
-  data.tar.gz: 2168efd5ad5afe44af7eb4246f33d781203dedc9251362ddd610e13aa19bce0059f66272049084f7bcb3f302739cff6a0b7ccb84c752f31a4b86d75b1d215814
+  metadata.gz: c479681a255e5faab29066c3fe06ebabc3d3b868572a0e99aa9c5400b50c691ef451a1c1d6cf3de5d188fcaa03b2b67276b015d9bbb4b8381f5209083f0ff66b
+  data.tar.gz: 798d4dd5d42818fa41d86d6a835716f7631516d8dd56605eae15125e6b50a9de7aac35a085d02a9f8d4a9443f2878a5de889c3ed266b81fea25c7b07caa30bc5

data/lib/rex/exploitation/vbsobfuscate.rb

@@ -0,0 +1,141 @@
+# -*- coding: binary -*-
+
+module Rex
+  module Exploitation
+    #
+    # VBScript obfuscation library
+    #
+    class VBSObfuscate
+      # The VBScript code that this obfuscator will transform
+      attr_accessor :code
+
+      # Saves +code+ for later obfuscation with #obfuscate!
+      #
+      # @param code [#to_s] the code to obfuscate
+      # @param opts [Hash] an options hash
+      def initialize(code = nil, _opts = {})
+        self.code = code
+      end
+
+      # @return [String] the (possibly obfuscated) code
+      def to_s
+        @code
+      end
+
+      # Append +str+ to the (possibly obfuscated) code
+      def <<(str)
+        @code << str
+      end
+
+      # Obfuscate VBScript code.
+      #
+      # @option iterations            [Integer] number of times to run the obfuscator on this code (1)
+      # @option normalize_whitespace  [Boolean] normalize line endings and strip leading/trailing whitespace from each line (true)
+      # @option dynamic_execution     [Boolean] dynamically execute obfuscated code with Execute (true)
+      #
+      # @return [self]
+      def obfuscate!(iterations: 1, normalize_whitespace: true, dynamic_execution: true)
+        raise(ArgumentError, 'code must be present') if @code.nil?
+        raise(ArgumentError, 'iterations must be a positive integer') unless iterations.integer? && iterations.positive?
+
+        obfuscated = @code.dup
+
+        iterations.times do
+          # Normalize line endings and strip leading/trailing whitespace
+          if normalize_whitespace
+            obfuscated.gsub!(/\r\n/, "\n")
+            obfuscated = obfuscated.lines.map(&:strip).reject(&:empty?).join("\n")
+          end
+
+          # Convert all VBScript to a string to be dynamically executed with Execute()
+          if dynamic_execution
+            obfuscated = 'Execute ' + vbscript_string_for_execute(obfuscated)
+          end
+
+          # Obfuscate strings
+          obfuscated = chunk_vbscript_strings(obfuscated)
+          obfuscated.gsub!(/"((?:[^"]|"")*)"/) do
+            raw = ::Regexp.last_match(1).gsub('""', '"')
+            raw.chars.map { |c| "chr(#{generate_number_expression(c.ord)})" }.join('&')
+          end
+
+          # Obfuscate integers
+          obfuscated.gsub!(/\b\d+\b/) do |num|
+            generate_number_expression(num.to_i)
+          end
+        end
+
+        @code = obfuscated
+
+        self
+      end
+
+      private
+
+      # Converts all VBScript in +vbscript+ to a string for dynamic execution
+      # with Execute().
+      #
+      # @param vbscript [String] VBScript code
+      #
+      # @return [String] obfuscated VBScript code for use with Execute()
+      def vbscript_string_for_execute(vbscript)
+        lines = vbscript.lines.map(&:chomp).map do |line|
+          escaped_line = line.gsub('"', '""')
+          "\"#{escaped_line}\""
+        end
+        lines.join('&vbCrLf&')
+      end
+
+      # Returns a random math expression evaluating to input +int+
+      #
+      # @param int [Integer] input integer
+      #
+      # @return [String] math expression evaluating to input +int+
+      def generate_number_expression(int)
+        case rand(4)
+        when 0 # Sum
+          a = rand(0..int)
+          b = int - a
+          "(#{a}+#{b})"
+        when 1 # Difference
+          r1 = int + rand(1..10)
+          r2 = r1 - int
+          "(#{r1}-#{r2})"
+        when 2 # Product (only if divisible)
+          divisors = (1..int).select { |d| (int % d).zero? }
+          if divisors.size > 1
+            d = divisors.sample
+            "(#{d}*#{int / d})"
+          else
+            "(#{int}+0)"
+          end
+        when 3 # Quotient
+          r2 = rand(1..10)
+          r1 = int * r2
+          "(#{r1}/#{r2})"
+        end
+      end
+
+      # Return VBScript code with all strings split into chunks and concatenated
+      #
+      # @param vbscript [String] VBScript code
+      #
+      # @return [String] VBScript code with chunked strings
+      def chunk_vbscript_strings(vbscript)
+        vbscript.gsub(/"([^"]+)"/) do
+          original = Regexp.last_match(1)
+          chunks = []
+
+          i = 0
+          while i < original.length
+            chunk_size = rand(1..5)
+            chunks << "\"#{original[i, chunk_size]}\""
+            i += chunk_size
+          end
+
+          chunks.join('&')
+        end
+      end
+    end
+  end
+end

data/lib/rex/exploitation/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Exploitation
-    VERSION = "0.1.42"
+    VERSION = "0.1.43"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rex-exploitation
 version: !ruby/object:Gem::Version
-  version: 0.1.42
+  version: 0.1.43
 platform: ruby
 authors:
 - Metasploit Hackers
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-05-02 00:00:00.000000000 Z
+date: 2025-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -229,6 +229,7 @@ files:
 - lib/rex/exploitation/opcodedb.rb
 - lib/rex/exploitation/ropdb.rb
 - lib/rex/exploitation/seh.rb
+- lib/rex/exploitation/vbsobfuscate.rb
 - lib/rex/exploitation/version.rb
 - rex-exploitation.gemspec
 homepage: https://github.com/rapid7/rex-exploitation