mirror of
https://github.com/XiaoliChan/wmiexec-Pro.git
synced 2026-10-21 00:37:59 +08:00
XiaoliChan
72 lines
2.6 KiB
Python
72 lines
2.6 KiB
Python
import random
|
|
import string
|
|
|
|
|
|
class VBSObfuscator:
|
|
def __init__(self):
|
|
pass
|
|
|
|
def randCapitalization(self, characters):
|
|
capicharacter = ""
|
|
for character in characters:
|
|
lowup = random.randrange(0,2)
|
|
if lowup == 0:
|
|
capicharacter += character.upper()
|
|
if lowup == 1:
|
|
capicharacter += character.lower()
|
|
return capicharacter
|
|
|
|
#Random mathematical expression decision
|
|
def expr(self, char):
|
|
range = random.randrange(100, 10001)
|
|
exp = random.randrange(0, 3)
|
|
if exp == 0:
|
|
return f"{(range+char)!s}-{range!s}"
|
|
if exp == 1:
|
|
return f"{(char-range)!s}+{range!s}"
|
|
if exp == 2:
|
|
return f"{(char*range)!s}/{range!s}"
|
|
|
|
def obfu(self, body):
|
|
encBody = ""
|
|
for i in range(0, len(body)):
|
|
if not encBody:
|
|
encBody += self.expr(ord(body[i]))
|
|
else:
|
|
encBody += f"*{self.expr(ord(body[i]))}"
|
|
return encBody
|
|
|
|
def generator(self, vbs_content=None):
|
|
#Splitter is set to be the "*" symbol,
|
|
#since we are not using it in obfuscation
|
|
splitter = str(chr(42))
|
|
|
|
#Random function names
|
|
NUM_OF_CHARS = random.randrange(5, 60)
|
|
pld = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
array = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
temp = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
x = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
|
|
#Random Sub names
|
|
subOne = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
subTwo = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in range(NUM_OF_CHARS))
|
|
|
|
#Write to destination file
|
|
obfuscated_file = "{0}\n{1}\n{2}\n{3}\n{4}\n{5}\n{6}\n{7}\n{8}\n{9}\n{10}\n{11}\n{12}\n".format(
|
|
self.randCapitalization(f"Dim {pld}, {array}, {temp}"),
|
|
self.randCapitalization(f"Sub {subOne}"),
|
|
f"{self.randCapitalization(f"{pld} = ")}{chr(34)}{self.obfu(vbs_content)}{chr(34)}",
|
|
f"{self.randCapitalization(f"{array} = Split({pld}, chr(eval(")}{self.obfu(splitter)})))",
|
|
self.randCapitalization(f"for each {x} in {array}"),
|
|
f"{self.randCapitalization(f"{temp} = {temp} & chr(eval({x}")}))",
|
|
self.randCapitalization("next"),
|
|
self.randCapitalization(subTwo),
|
|
self.randCapitalization("End Sub"),
|
|
self.randCapitalization(f"Sub {subTwo}"),
|
|
f"{self.randCapitalization(f"eval(execute({temp}")}))",
|
|
self.randCapitalization("End Sub"),
|
|
self.randCapitalization(subOne)
|
|
)
|
|
|
|
return obfuscated_file |