rex-exploitation 0.1.42 → 0.1.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6c3c655a61711289a496a809789adaedf0f252e96a3a60f30840627b3bc03cb
-  data.tar.gz: 91cdd049b97c784f989516329ba98c12252330dd2a4abce52cec0a5ae3cd9db4
+  metadata.gz: f95db6775c2b63c9e88cb814b0447bfcd3907e026ae8daa6949df37ca620f411
+  data.tar.gz: a0b71c494ced6fd66448674d3bb482fb3f8e82994e984bc0a644584ec3e1549a
 SHA512:
-  metadata.gz: e14c26a91cf648d4cabfea522a6cf9b871f30bb575bc482e8a06e153432dcd39c5153da72b92dd4b396516ca60e58c3006a988ab0e8ac1de98421d430de8f4c0
-  data.tar.gz: 2168efd5ad5afe44af7eb4246f33d781203dedc9251362ddd610e13aa19bce0059f66272049084f7bcb3f302739cff6a0b7ccb84c752f31a4b86d75b1d215814
+  metadata.gz: 61e4dba7238278e4820d476221fd3de8c8a86ec533a4ebcfeb4e13019bbe33556f7d85f6eea410848a8d86c1ccb6fd06de72a8259a1fba9d91ece011951aecfd
+  data.tar.gz: 6b902bc437632db80984d5b1831e5ebf596c530b9a9fde7823b4d981b15603459cd84382848e0f63dabfad523ac13c9b146c53424ea8086053700ed21d8b8c3d

data/README.md

@@ -14,12 +14,15 @@ gem 'rex-exploitation'
 
 And then execute:
 
-    $ bundle
+```
+bundle
+```
 
 Or install it yourself as:
 
-    $ gem install rex-exploitation
-
+``` 
+gem install rex-exploitation
+```
 
 ## Development
 

data/lib/rex/exploitation/vbsobfuscate.rb

@@ -0,0 +1,141 @@
+# -*- coding: binary -*-
+
+module Rex
+  module Exploitation
+    #
+    # VBScript obfuscation library
+    #
+    class VBSObfuscate
+      # The VBScript code that this obfuscator will transform
+      attr_accessor :code
+
+      # Saves +code+ for later obfuscation with #obfuscate!
+      #
+      # @param code [#to_s] the code to obfuscate
+      # @param opts [Hash] an options hash
+      def initialize(code = nil, _opts = {})
+        self.code = code
+      end
+
+      # @return [String] the (possibly obfuscated) code
+      def to_s
+        @code
+      end
+
+      # Append +str+ to the (possibly obfuscated) code
+      def <<(str)
+        @code << str
+      end
+
+      # Obfuscate VBScript code.
+      #
+      # @option iterations            [Integer] number of times to run the obfuscator on this code (1)
+      # @option normalize_whitespace  [Boolean] normalize line endings and strip leading/trailing whitespace from each line (true)
+      # @option dynamic_execution     [Boolean] dynamically execute obfuscated code with Execute (true)
+      #
+      # @return [self]
+      def obfuscate!(iterations: 1, normalize_whitespace: true, dynamic_execution: true)
+        raise(ArgumentError, 'code must be present') if @code.nil?
+        raise(ArgumentError, 'iterations must be a positive integer') unless iterations.integer? && iterations.positive?
+
+        obfuscated = @code.dup
+
+        iterations.times do
+          # Normalize line endings and strip leading/trailing whitespace
+          if normalize_whitespace
+            obfuscated.gsub!(/\r\n/, "\n")
+            obfuscated = obfuscated.lines.map(&:strip).reject(&:empty?).join("\n")
+          end
+
+          # Convert all VBScript to a string to be dynamically executed with Execute()
+          if dynamic_execution
+            obfuscated = 'Execute ' + vbscript_string_for_execute(obfuscated)
+          end
+
+          # Obfuscate strings
+          obfuscated = chunk_vbscript_strings(obfuscated)
+          obfuscated.gsub!(/"((?:[^"]|"")*)"/) do
+            raw = ::Regexp.last_match(1).gsub('""', '"')
+            raw.chars.map { |c| "chr(#{generate_number_expression(c.ord)})" }.join('&')
+          end
+
+          # Obfuscate integers
+          obfuscated.gsub!(/\b\d+\b/) do |num|
+            generate_number_expression(num.to_i)
+          end
+        end
+
+        @code = obfuscated
+
+        self
+      end
+
+      private
+
+      # Converts all VBScript in +vbscript+ to a string for dynamic execution
+      # with Execute().
+      #
+      # @param vbscript [String] VBScript code
+      #
+      # @return [String] obfuscated VBScript code for use with Execute()
+      def vbscript_string_for_execute(vbscript)
+        lines = vbscript.lines.map(&:chomp).map do |line|
+          escaped_line = line.gsub('"', '""')
+          "\"#{escaped_line}\""
+        end
+        lines.join('&vbCrLf&')
+      end
+
+      # Returns a random math expression evaluating to input +int+
+      #
+      # @param int [Integer] input integer
+      #
+      # @return [String] math expression evaluating to input +int+
+      def generate_number_expression(int)
+        case rand(4)
+        when 0 # Sum
+          a = rand(0..int)
+          b = int - a
+          "(#{a}+#{b})"
+        when 1 # Difference
+          r1 = int + rand(1..10)
+          r2 = r1 - int
+          "(#{r1}-#{r2})"
+        when 2 # Product (only if divisible)
+          divisors = (1..int).select { |d| (int % d).zero? }
+          if divisors.size > 1
+            d = divisors.sample
+            "(#{d}*#{int / d})"
+          else
+            "(#{int}+0)"
+          end
+        when 3 # Quotient
+          r2 = rand(1..10)
+          r1 = int * r2
+          "(#{r1}/#{r2})"
+        end
+      end
+
+      # Return VBScript code with all strings split into chunks and concatenated
+      #
+      # @param vbscript [String] VBScript code
+      #
+      # @return [String] VBScript code with chunked strings
+      def chunk_vbscript_strings(vbscript)
+        vbscript.gsub(/"([^"]+)"/) do
+          original = Regexp.last_match(1)
+          chunks = []
+
+          i = 0
+          while i < original.length
+            chunk_size = rand(1..5)
+            chunks << "\"#{original[i, chunk_size]}\""
+            i += chunk_size
+          end
+
+          chunks.join('&')
+        end
+      end
+    end
+  end
+end

data/lib/rex/exploitation/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Exploitation
-    VERSION = "0.1.42"
+    VERSION = "0.1.44"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rex-exploitation
 version: !ruby/object:Gem::Version
-  version: 0.1.42
+  version: 0.1.44
 platform: ruby
 authors:
 - Metasploit Hackers
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-05-02 00:00:00.000000000 Z
+date: 2025-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -229,6 +229,7 @@ files:
 - lib/rex/exploitation/opcodedb.rb
 - lib/rex/exploitation/ropdb.rb
 - lib/rex/exploitation/seh.rb
+- lib/rex/exploitation/vbsobfuscate.rb
 - lib/rex/exploitation/version.rb
 - rex-exploitation.gemspec
 homepage: https://github.com/rapid7/rex-exploitation