Class: Rex::Powershell::Script

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Includes:
Obfu, Output, Parser
Defined in:
lib/rex/powershell/script.rb

Constant Summary

Constants included from Obfu

Obfu::EMPTY_LINE_REGEX, Obfu::MULTI_LINE_COMMENTS_REGEX, Obfu::SINGLE_LINE_COMMENTS_REGEX, Obfu::UNIX_EOL_REGEX, Obfu::WHITESPACE_REGEX, Obfu::WINDOWS_EOL_REGEX

Constants included from Parser

Parser::RESERVED_VARIABLE_NAMES

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Obfu

#standard_subs, #strip_comments, #strip_empty_lines, #strip_whitespace, #sub_funcs, #sub_vars

Methods included from Parser

#block_extract, #get_func, #get_func_names, #get_string_literals, #get_var_names, #match_start, #scan_with_index

Methods included from Output

#compress_code, #decode_code, #decompress_code, #deflate_code, #encode_code, #gzip_code, #size, #to_s, #to_s_lineno

Constructor Details

#initialize(code) ⇒ Script 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
 
# File 'lib/rex/powershell/script.rb', line 34

def initialize(code)
  @code = ''
  @rig = Rex::RandomIdentifier::Generator.new

  begin
    # Open code file for reading
    fd = ::File.new(code || '', 'rb')
    while (line = fd.gets)
      @code << line
    end

    # Close open file
    fd.close
  rescue Errno::ENAMETOOLONG, Errno::ENOENT
    # Treat code as a... code
    @code = code.to_s.dup # in case we're eating another script
  end
  @functions = get_func_names.map { |f| get_func(f) }
end

Instance Attribute Details

#code ⇒ Object

Returns the value of attribute code.



9
10
11
 
# File 'lib/rex/powershell/script.rb', line 9

def code
  @code
end

#functions ⇒ Object (readonly)

Returns the value of attribute functions.



10
11
12
 
# File 'lib/rex/powershell/script.rb', line 10

def functions
  @functions
end

#rig ⇒ Object (readonly)

Returns the value of attribute rig.



10
11
12
 
# File 'lib/rex/powershell/script.rb', line 10

def rig
  @rig
end

Class Method Details

.code_modifiers ⇒ Array

Return list of code modifier methods



92
93
94
 
# File 'lib/rex/powershell/script.rb', line 92

def self.code_modifiers
  instance_methods.select { |m| m =~ /^(strip|sub)/ }
end

.to_byte_array(input_data, var_name = Rex::Text.rand_text_alpha(rand(3) + 3)) ⇒ String

Convert binary to byte array, read from file if able



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'lib/rex/powershell/script.rb', line 66

def self.to_byte_array(input_data, var_name = Rex::Text.rand_text_alpha(rand(3) + 3))
  # File will raise an exception if the path contains null byte
  if input_data.include? "\x00"
    code = input_data
  else
    code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
  end

  code = code.unpack('C*')
  psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
  lines = []
  1.upto(code.length - 1) do |byte|
    if (byte % 10 == 0)
      lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
    else
      lines.push ",0x#{code[byte].to_s(16)}"
    end
  end

  psh << lines.join('') + "\r\n"
end