justyy avatar

Advanced ROT47 VBScript Obfuscator in VBScript

justyy

Published: 23 Dec 2017 › Updated: 23 Dec 2017Advanced ROT47 VBScript Obfuscator in VBScript

Advanced ROT47 VBScript Obfuscator in VBScript

Previously, the very basic VBScript obfuscator has been accepted by utopian. However, the obfuscated source code is lengthy, which is made up by chr functions.

Today, I have added another VBScript obfuscator using the rot47 technique. Here is How it looks like for original un-obfuscated VBScript source:

MsgBox "Hello, @justyy"

And after obfuscation, here is the version that protects itself from an easy glance.

Function l(str):Dim i,j,k,r:j=Len(str):r="":For i=1 to j:k=Asc(Mid(str,i,1)):If k>=33 And k<=126 Then:r=r&Chr(33+((k+14)Mod 94)):Else:r=r&Chr(k):End If:Next:l=r:End Function
Execute l("|D8q@I Qw6==@[ o;FDEJJQ")

image.png

Similar to previous obfuscator, you can obfuscate the VBS via the command line, for example:

cscript.exe vbs_rot47_obfuscator.vbs sample.vbs > sample-obfuscated.vbs

How it works?

The ROT47 is a Caesar cipher by 47 chars. If you apply rot47 on the same string twice, you will get its original version:

Function Rot47(str)
    Dim i, j, k, r
    j = Len(str)
    r = ""
    For i = 1 to j
        k = Asc(Mid(str, i, 1))
        If k >= 33 And k <= 126 Then
            r = r & Chr(33 + ((k + 14) Mod 94))
        Else
            r = r & Chr(k)
        End If
    Next
    Rot47 = r
End Function
Function Obfuscator(vbs)
    Dim length, s, i, F
    F = "Function l(str):Dim i,j,k,r:j=Len(str):r=" & Chr(34) & Chr(34) & ":For i=1 to j:k=Asc(Mid(str,i,1)):If k>=33 And k<=126 Then:r=r&Chr(33+((k+14)Mod 94)):Else:r=r&Chr(k):End If:Next:l=r:End Function"
    length = Len(vbs)
    s = ""
    For i = 1 To length
        s = s & Rot47(Mid(vbs, i, 1))
    Next    
    Obfuscator = F & vbCrlf & "Execute l(" & Chr(34) & (s)& Chr(34) &")" & vbCrLf 
End Function

Github: https://github.com/DoctorLai/VBScript_Obfuscator
This commit: https://github.com/DoctorLai/VBScript_Obfuscator/commit/3465706f2e27b159a4a8769ca644fdb0a62de963#diff-eee917fa686f483d877fc2b1d9e7e886



Posted on Utopian.io - Rewarding Open Source Contributors

Leave Advanced ROT47 VBScript Obfuscator in VBScript to:

Written by

I am on STEEM - steem is the best

Read more #utopian-io posts


Best Posts From justyy

We have not curated any of justyy's posts yet. But you can encourage our curation team to review posts by visiting them regularly and by referring other readers. Because we give priority to frequently read content.

More Posts From justyy