metasploit-framework/lib/rex/exploitation/jsobfu.rb

##
# $Id$
##

require 'rex/text'
require 'rkelly'

module Rex
module Exploitation


#
# Obfuscate JavaScript by randomizing as much as possible and removing
# easily-signaturable string constants.
#
# Example:
#   js = ::Rex::Exploitation::JSObfu.new %Q|
#     var a = "0\\612\\063\\x34\\x35\\x36\\x37\\x38\\u0039";
#     var b = { foo : "foo", bar : "bar" }
#     alert(a);
#     alert(b.foo);
#   |
#   js.obfuscate
#   puts js
# Example Output:
#   var VwxvESbCgv = String.fromCharCode(0x30,0x31,062,063,064,53,0x36,067,070,0x39);
#   var ToWZPn = {
#     "\146\157\x6f": (function () { var yDyv="o",YnCL="o",Qcsa="f"; return Qcsa+YnCL+yDyv })(),
#     "\142ar": String.fromCharCode(0142,97,0162)
#   };
#   alert(VwxvESbCgv);
#   alert(ToWZPn.foo);
#
# NOTE: Variables MUST be declared with a 'var' statement BEFORE first use (or
# not at all) for this to generate correct code!  If variables are not declared
# they will not be randomized but the generated code will be correct.
#
# Bad Example Javascript:
#   a = "asdf"; // this variable hasn't been declared and will not be randomized
#   var a;
#   alert(a); // real js engines will alert "asdf" here
# Bad Example Obfuscated:
#   a = (function () { var hpHu="f",oyTm="asd"; return oyTm+hpHu })();
#   var zSrnHpEfJZtg;
#   alert(zSrnHpEfJZtg);
# Notice that the first usage of +a+ (before it was declared) is not
# randomized.  Thus, the obfuscated version will alert 'undefined' instead of
# "asdf".
#
class JSObfu

	#
	# Abstract Syntax Tree generated by RKelly::Parser#parse
	#
	attr_reader :ast

	#
	# Saves +code+ for later obfuscation with #obfuscate
	#
	def initialize(code)
		@code = code
		@funcs = {}
		@vars  = {}
		@debug = false
	end

	#
	# Add +str+ to the un-obfuscated code.
	#
	# Calling this method after #obfuscate is undefined
	#
	def <<(str)
		@code << str
	end

	#
	# Return the (possibly obfuscated) code as a string.
	#
	# If #obfuscate has not been called before this, returns the parsed,
	# unobfuscated code.  This can be useful for example to remove comments and
	# standardize spacing.
	#
	def to_s
		parse if not @ast
		@ast.to_ecma
	end

	#
	# Return the obfuscated name of a symbol
	#
	# You MUST call #obfuscate before this method!
	#
	def sym(lookup)
		if @vars[lookup]
			ret = @vars[lookup]
		elsif @funcs[lookup]
			ret = @funcs[lookup]
		else
			ret = lookup
		end
		ret
	end

	#
	# Parse and obfuscate
	#
	def obfuscate
		parse
		obfuscate_r(@ast)
	end

protected

	#
	# Recursive method to obfuscate the given +ast+.
	#
	# +ast+ should be the result of RKelly::Parser#parse
	#
	def obfuscate_r(ast)
		ast.each do |node|
			#if node.respond_to? :value and node.value.kind_of? String and node.value =~ /bodyOnLoad/i
			#	$stdout.puts("bodyOnLoad: #{node.class}: #{node.value}")
			#end

			case node
			when nil
				nil

			when ::RKelly::Nodes::SourceElementsNode
				# Recurse
				obfuscate_r(node.value)

			#when ::RKelly::Nodes::ObjectLiteralNode
				# TODO
				#$stdout.puts(node.methods - Object.new.methods)
				#$stdout.puts(node.value.inspect)

			when ::RKelly::Nodes::PropertyNode
				# Property names must be bare words or string literals NOT
				# expressions!  Can't use transform_string() here
				if node.name =~ /^[a-zA-Z_][a-zA-Z0-9_]*$/
					n = '"'
					node.name.unpack("C*") { |c|
						case rand(3)
						when 0; n << "\\x%02x"%(c)
						when 1; n << "\\#{c.to_s 8}"
						when 2; n << [c].pack("C")
						end
					}
					n << '"'
					node.name = n
				end

			# Variables
			when ::RKelly::Nodes::VarDeclNode
				if @vars[node.name].nil?
					#@vars[node.name] = "var_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.name}"
					@vars[node.name] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
				end
				node.name = @vars[node.name]
			when ::RKelly::Nodes::ParameterNode
				if @vars[node.value].nil?
					#@vars[node.value] = "param_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.value}"
					@vars[node.value] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
				end
				node.value = @vars[node.value]
			when ::RKelly::Nodes::ResolveNode
				#$stdout.puts("Resolve bodyOnload: #{@vars[node.value]}") if "bodyOnLoad" == node.value
				node.value = @vars[node.value] if @vars[node.value]
			when ::RKelly::Nodes::DotAccessorNode
				case node.value
				when ::RKelly::Nodes::ResolveNode
					if @vars[node.value.value]
						node.value.value = @vars[node.value.value]
					end
				#else
				#	$stderr.puts("Non-resolve node as target of dotaccessor: #{node.value.class}")
				end

			# Functions
			when ::RKelly::Nodes::FunctionDeclNode
				#$stdout.puts("FunctionDecl: #{node.value}")
				# Functions can also act as objects, so store them in the vars
				# and the functions list so we can replace them in both places
				if @funcs[node.value].nil? and not @funcs.values.include?(node.value)
					#@funcs[node.value] = "func_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.value}"
					@funcs[node.value] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
					if @vars[node.value].nil?
						@vars[node.value] = @funcs[node.value]
					end
					node.value = @funcs[node.value]
				end
			when ::RKelly::Nodes::FunctionCallNode
				# The value of a FunctionCallNode is some sort of accessor node or a ResolveNode
				# so this is basically useless
				#$stdout.puts("Function call: #{node.name} => #{@funcs[node.name]}")
				#node.value = @funcs[node.value] if @funcs[node.value]

			# Transformers
			when ::RKelly::Nodes::NumberNode
				node.value = transform_number(node.value)
			when ::RKelly::Nodes::StringNode
				node.value = transform_string(node.value)
			else
				#$stderr.puts "#{node.class}: #{node.value}"
				#$stderr.puts "#{node.class}"
			end

			#unless node.kind_of? ::RKelly::Nodes::SourceElementsNode
			#	$stderr.puts "#{node.class}: #{node.value}"
			#end
		end

		nil
	end

	#
	# Generate an Abstract Syntax Tree (#ast) for later obfuscation
	#
	def parse
		parser = RKelly::Parser.new
		@ast = parser.parse(@code)
	end

	#
	# Convert a number to a random base (decimal, octal, or hexedecimal).
	#
	# Given 10 as input, the possible return values are:
	#   "10"
	#   "0xa"
	#   "012"
	#
	def rand_base(num)
		case rand(3)
		when 0; num.to_s
		when 1; "0%o" % num
		when 2; "0x%x" % num
		end
	end

	#
	# Return a mathematical expression that will evaluate to the given number
	# +num+.
	#
	# +num+ can be a float or an int, but should never be negative.
	#
	def transform_number(num)
		case num
		when Fixnum
			if num == 0
				r = rand(10) + 1
				transformed = "('#{Rex::Text.rand_text_alpha(r)}'.length - #{r})"
			elsif num > 0 and num < 10
				# use a random string.length for small numbers
				transformed = "'#{Rex::Text.rand_text_alpha(num)}'.length"
			else
				transformed = "("
				divisor = rand(num) + 1
				a = num / divisor.to_i
				b = num - (a * divisor)
				# recurse half the time for a
				a = (rand(2) == 0) ? transform_number(a) : rand_base(a)
				# recurse half the time for divisor
				divisor = (rand(2) == 0) ? transform_number(divisor) : rand_base(divisor)
				transformed << "#{a}*#{divisor}"
				transformed << "+#{b}"
				transformed << ")"
			end
		when Float
			transformed = "(#{num - num.floor} + #{rand_base(num.floor)})"
		end

		#puts("#{num} == #{transformed}")

		transformed
	end

	#
	# Convert a javascript string into something that will generate that string.
	#
	# Randomly calls one of the +transform_string_*+ methods
	#
	def transform_string(str)
		quote = str[0,1]
		# pull off the quotes
		str = str[1,str.length - 2]
		return quote*2 if str.length == 0

		case rand(2)
		when 0
			transformed = transform_string_split_concat(str, quote)
		when 1
			transformed = transform_string_fromCharCode(str)
		#when 2
		#	# Currently no-op
		#	transformed = transform_string_unescape(str)
		end

		#$stderr.puts "Obfuscating str: #{str.ljust 30} #{transformed}"
		transformed
	end

	#
	# Split a javascript string, +str+, without breaking escape sequences.
	#
	# The maximum length of each piece of the string is half the total length
	# of the string, ensuring we (almost) always split into at least two
	# pieces.  This won't always be true when given a string like "AA\x41",
	# where escape sequences artificially increase the total length (escape
	# sequences are considered a single character).
	#
	# Returns an array of two-element arrays.  The zeroeth element is a
	# randomly generated variable name, the first is a piece of the string
	# contained in +quote+s.
	#
	# See #escape_length
	#
	def safe_split(str, quote)
		parts = []
		max_len = str.length / 2
		while str.length > 0
			len = 0
			loop do
				e_len = escape_length(str[len..-1])
				e_len = 1 if e_len.nil?
				len += e_len
				# if we've reached the end of the string, bail
				break unless str[len]
				break if len > max_len
				# randomize the length of each part
				break if (rand(4) == 0)
			end

			part = str.slice!(0, len)

			var = Rex::Text.rand_text_alpha(4)
			parts.push( [ var, "#{quote}#{part}#{quote}" ] )
		end

		parts
	end

	#
	# Stolen from obfuscatejs.rb
	#
	# Determines the length of an escape sequence
	#
	def escape_length(str)
		esc_len = nil
		if str[0,1] == "\\"
			case str[1,1]
			when "u"; esc_len = 6     # unicode \u1234
			when "x"; esc_len = 4     # hex, \x41
			when /[0-7]/              # octal, \123, \0
				str[1,3] =~ /([0-7]{1,3})/
				if $1.to_i(8) > 255
					str[1,3] =~ /([0-7]{1,2})/
				end
				esc_len = 1 + $1.length
			else; esc_len = 2         # \" \n, etc.
			end
		end
		esc_len
	end

	#
	# Split a javascript string, +str+, into multiple randomly-ordered parts
	# and return an anonymous javascript function that joins them in the
	# correct order.  This method can be called safely on strings containing
	# escape sequences.  See #safe_split.
	#
	def transform_string_split_concat(str, quote)
		parts = safe_split(str, quote)
		func = "(function () { var "
		ret = "; return "
		parts.sort { |a,b| rand }.each do |part|
			func << "#{part[0]}=#{part[1]},"
		end
		func.chop!

		ret  << parts.map{|part| part[0]}.join("+")
		final = func + ret + " })()"

		final
	end


	# TODO
	#def transform_string_unescape(str)
	#	str
	#end

	#
	# Return a call to String.fromCharCode() with each char of the input as arguments
	#
	# Example:
	#   input : "A\n"
	#   output: String.fromCharCode(0x41, 10)
	#
	def transform_string_fromCharCode(str)
		buf = "String.fromCharCode("
		bytes = str.unpack("C*")
		len = 0
		while str.length > 0
			if str[0,1] == "\\"
				str.slice!(0,1)
				# then this is an escape sequence and we need to deal with all
				# the special cases
				case str[0,1]
				# For chars that contain their non-escaped selves, step past
				# the backslash and let the rand_base() below decide how to
				# represent the character.
				when '"', "'", "\\", " "
					char = str.slice!(0,1).unpack("C").first
				# For symbolic escapes, use the known value
				when "n"; char = 0x0a; str.slice!(0,1)
				when "t"; char = 0x09; str.slice!(0,1)
				# Lastly, if it's a hex, unicode, or octal escape, pull out the
				# real value and use that
				when "x"
					# Strip the x
					str.slice!(0,1)
					char = str.slice!(0,2).to_i 16
				when "u"
					# This can potentially lose information in the case of
					# characters like \u0041, but since regular ascii is stored
					# as unicode internally, String.fromCharCode(0x41) will be
					# represented as 00 41 in memory anyway, so it shouldn't
					# matter.
					str.slice!(0,1)
					char = str.slice!(0,4).to_i 16
				when /[0-7]/
					# Octals are a bit harder since they are variable width and
					# don't necessarily mean what you might think. For example,
					# "\61" == "1" and "\610" == "10".  610 is a valid octal
					# number, but not a valid ascii character.  Javascript will
					# interpreter as much as it can as a char and use the rest
					# as a literal.  Boo.
					str =~ /([0-7]{1,3})/
					char = $1.to_i 8
					if char > 255
						str =~ /([0-7]{1,2})/
						char = $1.to_i 8
					end
					str.slice!(0,$1.length)
				end
			else
				char = str.slice!(0,1).unpack("C").first
			end
			buf << "#{rand_base(char)},"
		end
		# Strip off the last comma
		buf = buf[0,buf.length-1] + ")"
		transformed = buf

		transformed
	end


end
end
end


=begin
if __FILE__ == $0
	if ARGV[0]
		code = File.read(ARGV[0])
	else
		#require 'rex/exploitation/javascriptosdetect'
		#code = Rex::Exploitation::JavascriptOSDetect.new.to_s
		code = <<-EOS
			// Should alert "0123456789"
			var a = "0\\612\\063\\x34\\x35\\x36\\x37\\x38\\u0039";
			var a,b=2,c=3;
			alert(a);
			// should alert "asdfjkl;"
			var d = (function() { var foo = "jkl;", blah = "asdf"; return blah + foo; })();
			alert(d);
		EOS
	end
	js = Rex::Exploitation::JSObfu.new(code)
	js.obfuscate
	puts js.to_s

end

=end