Rex::Exploitation::VBSObfuscate: Add VBScript obfuscation library#47
Merged
adfoster-r7 merged 1 commit intorapid7:masterfrom Sep 24, 2025
Merged
Rex::Exploitation::VBSObfuscate: Add VBScript obfuscation library#47adfoster-r7 merged 1 commit intorapid7:masterfrom
adfoster-r7 merged 1 commit intorapid7:masterfrom
Conversation
Contributor
Author
Dim JbddUBzJRbRrVfg
For JbddUBzJRbRrVfg = 1 To 5
JbddUBzJRbRrVfg = JbddUBzJRbRrVfg + 0
Next
Dim aDvkcFnDGayWffd
For aDvkcFnDGayWffd = 1 To 4
aDvkcFnDGayWffd = aDvkcFnDGayWffd + 0
Next
Function hdySkwGHxJ(OTiALVCdLc)
hdySkwGHxJ = OTiALVCdLc * 2
End Function
Sub EjQtgCpFQ(qaNGszbDuR)
EjQtgCpFQ = qaNGszbDuR * 5
End Sub
Sub AVGbBw(hZyqkvEtkrobpPJ)
AVGbBw = hZyqkvEtkrobpPJ * 1
End Sub
Dim wDCJEsaZBDXo, kGhiVFpu
wDCJEsaZBDXo = 0
kGhiVFpu = 87
Sub xHMTnrcKyD(dAKXbMjoLp)
xHMTnrcKyD = dAKXbMjoLp * 3
End Sub
Sub BgBEFkeDKRZG(TbXNxKjhXTZJS)
BgBEFkeDKRZG = TbXNxKjhXTZJS * 5
End Sub
Dim UnMdYWeu
For UnMdYWeu = 1 To 4
UnMdYWeu = UnMdYWeu + 0
Next
MsgBox "hello!" |
adfoster-r7
reviewed
Sep 24, 2025
| # Normalize line endings and strip leading/trailing whitespace | ||
| if strip_whitespace | ||
| obfuscated.gsub!(/\r\n/, "\n") | ||
| obfuscated = obfuscated.lines.map(&:strip).reject(&:empty?).join("\n") |
Contributor
There was a problem hiding this comment.
Maybe a misunderstanding on my part - i assumed strip_whitespace would remove whitespace, but this seem to actually just be 'normalize'? 🤔
If the intent is stripping, would this work (not tested)
Suggested change
| obfuscated = obfuscated.lines.map(&:strip).reject(&:empty?).join("\n") | |
| obfuscated = obfuscated.lines.map(&:strip).reject(&:empty?).join(';') |
Or if the intent is normalization maybe renaming the option could be good for clarity
- if strip_whitespace
+ if normalize_whitespace
Contributor
Author
There was a problem hiding this comment.
Maybe a misunderstanding on my part - i assumed
strip_whitespacewould remove whitespace, but this seem to actually just be 'normalize'? 🤔
It removes lines which contain only whitespace and "strips" leading and trailing whitepace on all lines:
# irb
irb(main):001> ' asdf asdf asdf '.strip
=> "asdf asdf asdf"
irb(main):002> Or if the intent is normalization maybe renaming the option could be good for clarity
To me, "normalize" seems equally as vague as "strip" here, but I'll change it.
If it's stripping, would this work (not tested)
No. VBS does not support command concatenation with ; - only new lines.
bcoles
force-pushed
the
vbsobfuscator
branch
from
1fabf13 to
dd7d8d3
Compare
adfoster-r7
approved these changes
Sep 24, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a simple VBS obfuscator.
I tried to stick with the convention, structure, and existing interfaces of the existing JSObfu library, with a few differences:
obfuscate!method name is used (instead ofobfuscate) as the object is modified in placememory_sensitiveoption is not implementediterationsoption is supported, but not very useful. Note that using any obfuscation level beyonditerations: 3is time consuming and not recommended. When dynamic_execution is used (default),iterations: 1is recommended.