metasploit-framework/lib/rex/exploitation/obfuscatejs.rb

# -*- coding: binary -*-
require 'rex/text'
module Rex
module Exploitation

#
# Obfuscates javascript in various ways
#
class ObfuscateJS
  attr_reader :opts

  #
  # Obfuscates a javascript string.
  #
  # Options are 'Symbols', described below, and 'Strings', a boolean
  # which specifies whether strings within the javascript should be
  # mucked with (defaults to false).
  #
  # The 'Symbols' argument should have the following format:
  #
  #   {
  #      'Variables'  => [ 'var1', ... ],
  #      'Methods'    => [ 'method1', ... ],
  #      'Namespaces' => [ 'n', ... ],
  #      'Classes'    => [ { 'Namespace' => 'n', 'Class' => 'y'}, ... ]
  #   }
  #
  # Make sure you order your methods, classes, and namespaces by most
  # specific to least specific to prevent partial substitution.  For
  # instance, if you have two methods (joe and joeBob), you should place
  # joeBob before joe because it is more specific and will be globally
  # replaced before joe is replaced.
  #
  # A simple example follows:
  #
  # <code>
  # js = ObfuscateJS.new <<ENDJS
  #     function say_hi() {
  #         var foo = "Hello, world";
  #         document.writeln(foo);
  #     }
  # ENDJS
  # js.obfuscate(
  #     'Symbols' => {
  #	       'Variables' => [ 'foo' ],
  #	       'Methods'   => [ 'say_hi' ]
  #	  }
  #     'Strings' => true
  # )
  # </code>
  #
  # which should generate something like the following:
  #
  # <code>
  # function oJaDYRzFOyJVQCOHk() { var cLprVG = "\x48\x65\x6c\x6c\x6f\x2c\x20\x77\x6f\x72\x6c\x64"; document.writeln(cLprVG); }
  # </code>
  #
  # String obfuscation tries to deal with escaped quotes within strings but
  # won't catch things like
  #     "\\"
  # so be careful.
  #
  def self.obfuscate(js, opts = {})
    ObfuscateJS.new(js).obfuscate(opts)
  end

  #
  # Initialize an instance of the obfuscator
  #
  def initialize(js = "", opts = {})
    @js      = js
    @dynsym  = {}
    @opts    = {
      'Symbols' => {
        'Variables'=>[],
        'Methods'=>[],
        'Namespaces'=>[],
        'Classes'=>[]
      },
      'Strings'=>false
    }
    @done = false
    update_opts(opts) if (opts.length > 0)
  end

  def update_opts(opts)
    if (opts.nil? or opts.length < 1)
      return
    end
    if (@opts['Symbols'] && opts['Symbols'])
      ['Variables', 'Methods', 'Namespaces', 'Classes'].each { |k|
        if (@opts['Symbols'][k] && opts['Symbols'][k])
          opts['Symbols'][k].each { |s|
            if (not @opts['Symbols'][k].include? s)
              @opts['Symbols'][k].push(s)
            end
          }
        elsif (opts['Symbols'][k])
          @opts['Symbols'][k] = opts['Symbols'][k]
        end
      }
    elsif opts['Symbols']
      @opts['Symbols'] = opts['Symbols']
    end
    @opts['Strings'] ||= opts['Strings']
  end

  #
  # Returns the dynamic symbol associated with the supplied symbol name
  #
  # If obfuscation has not yet been performed (i.e. obfuscate() has not been
  # called), then this method simply returns its argument
  #
  def sym(name)
    @dynsym[name] || name
  end

  #
  # Obfuscates the javascript string passed to the constructor
  #
  def obfuscate(opts = {})
    #return @js if (@done)
    @done = true

    update_opts(opts)

    if (@opts['Strings'])
      obfuscate_strings()

      # Full space randomization does not work for javascript -- despite
      # claims that space is irrelavent, newlines break things.  Instead,
      # use only space (0x20) and tab (0x09).

      #@js.gsub!(/[\x09\x20]+/) { |s|
      #	len = rand(50)+2
      #	set = "\x09\x20"
      #	buf = ''
      #	while (buf.length < len)
      #		buf << set[rand(set.length)].chr
      #	end
      #
      #	buf
      #}
    end

    # Remove our comments
    remove_comments

    # Globally replace symbols
    replace_symbols(@opts['Symbols']) if @opts['Symbols']

    return @js
  end

  #
  # Returns the replaced javascript string
  #
  def to_s
    @js
  end
  alias :to_str :to_s

  def <<(str)
    @js << str
  end
  def +(str)
    @js + str
  end

protected
  attr_accessor :done

  #
  # Get rid of both single-line C++ style comments and multiline C style comments.
  #
  # Note: embedded comments (e.g.: "/*/**/*/") will break this,
  # but they also break real javascript engines so I don't care.
  #
  def remove_comments
    @js.gsub!(%r{\s+//.*$}, '')
    @js.gsub!(%r{/\*.*?\*/}m, '')
  end

  # Replace method, class, and namespace symbols found in the javascript
  # string
  def replace_symbols(symbols)
    taken = { }

    # Generate random symbol names
    [ 'Variables', 'Methods', 'Classes', 'Namespaces' ].each { |symtype|
      next if symbols[symtype].nil?
      symbols[symtype].each { |sym|
        dyn = Rex::Text.rand_text_alpha(rand(32)+1) until dyn and not taken.key?(dyn)

        taken[dyn] = true

        if symtype == 'Classes'
          full_sym = sym['Namespace'] + "." + sym['Class']
          @dynsym[full_sym] = dyn

          @js.gsub!(/#{full_sym}/) { |m|
            sym['Namespace'] + "." + dyn
          }
        else
          @dynsym[sym] = dyn

          @js.gsub!(/#{sym}/, dyn)
        end
      }
    }
  end

  #
  # Change each string into some javascript that will generate that string
  #
  # There are a couple of caveats to using string obfuscation:
  #   * it tries to deal with escaped quotes within strings but won't catch
  #     things like: "\\"
  #   * depending on the random choices, this can easily balloon a short
  #     string up to hundreds of kilobytes if called multiple times.
  # so be careful.
  #
  def obfuscate_strings()
    @js.gsub!(/".*?[^\\]"|'.*?[^\\]'/) { |str|
      buf = ''
      quote = str[0,1]
      # Pull the quotes off either end
      str = str[1, str.length-2]
      case (rand(2))
      # Disable hex encoding for now.  It's just too big a hassle.
      #when 0
      #	# This is where we can run into trouble with generating
      #	# incorrect code.  If we hex encode a string twice, the second
      #	# encoding will generate the first instead of the original
      #	# string.
      #	if str =~ /\\x/
      #		# Always have to remove spaces from strings so the space
      #		# randomization doesn't mess with them.
      #		buf = quote + str.gsub(/ /, '\x20') + quote
      #	else
      #		buf = '"' + Rex::Text.to_hex(str) + '"'
      #	end
      when 0
        #
        # Escape sequences when naively encoded for unescape become a
        # literal backslash instead of the intended meaning.  To avoid
        # that problem, we scan the string for escapes and leave them
        # unmolested.
        #
        buf << 'unescape("'
        bytes = str.unpack("C*")
        c = 0
        while bytes[c]
          if bytes[c].chr == "\\"
            # XXX This is pretty slow.
            esc_len = parse_escape(bytes, c)
            buf << bytes[c, esc_len].map{|a| a.chr}.join
            c += esc_len
            next
          end
          buf << "%%%0.2x"%(bytes[c])
          # Break the string into smaller strings
          if bytes[c+1] and rand(10) == 0
            buf << '" + "'
          end
          c += 1
        end
        buf << '")'
      when 1
        buf = "String.fromCharCode( "
        bytes = str.unpack("C*")
        c = 0
        while bytes[c]
          if bytes[c].chr == "\\"
            case bytes[c+1].chr
            # For chars that contain their non-escaped selves, step
            # past the backslash and let the rand() below decide
            # how to represent the character.
            when '"'; c += 1
            when "'"; c += 1
            when "\\"; c += 1
            # For others, just take the hex representation out of
            # laziness.
            when "n"; buf << "0x0a"; c += 2; next
            when "t"; buf << "0x09"; c += 2; next
            # Lastly, if it's a hex, unicode, or octal escape,
            # leave it, and anything after it, alone.  At some
            # point we may want to parse up to the end of the
            # escapes and encode subsequent non-escape characters.
            # Since this is the lazy way to do it, spaces after an
            # escape sequence will get away unmodified.  To prevent
            # the space randomizer from hosing the string, convert
            # spaces specifically.
            else
              buf = buf[0,buf.length-1] + " )"
              buf << ' + ("' + bytes[c, bytes.length].map{|a| a==0x20 ? '\x20' : a.chr}.join + '" '
              break
            end
          end
          case (rand(3))
          when 0
            buf << " %i,"%(bytes[c])
          when 1
            buf << " 0%o,"%(bytes[c])
          when 2
            buf << " 0x%0.2x,"%(bytes[c])
          end
          c += 1
        end
        # Strip off the last comma
        buf = buf[0,buf.length-1] + " )"
      end
      buf
    }
    @js
  end

  def parse_escape(bytes, offset)
    esc_len = 0
    if bytes[offset].chr == "\\"
      case bytes[offset+1].chr
      when "u"; esc_len = 6     # unicode \u1234
      when "x"; esc_len = 4     # hex, \x41
      when /[0-9]/              # octal, \123, \0
        oct = bytes[offset+1, 4].map{|a|a.chr}.join
        oct =~ /([0-9]+)/
        esc_len = 1 + $1.length
      else; esc_len = 2         # \" \n, etc.
      end
    end
    esc_len
  end
end

end
end