Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Powershell script deobfuscation using AST in Python

License

NotificationsYou must be signed in to change notification settings

thewhiteninja/deobshell

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

46 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

GitHub licenseLanguage: PythonCross-platformv1.0


DeobShell is PoC to deobfuscate Powershell using Abstract Syntax Tree (AST) manipulation in Python.The AST is extracted using a Powershell script by callingSystem.Management.Automation.Language.Parser andwriting relevant nodes to an XML file.

AST manipulation and optimization is based on a set of rules (ex: concat constant string, apply format operator ...).

From the deobfuscated AST, a ps1 script is rebuilt using Python.See the diagram below.

ℹ️ Only a subset of Powershell is supported for now but PR are welcomed :)

⚠️data/ folder contains real malware samples!

How

diagram

Examples of rules

  • remove empty nodes
  • remove unused variables
  • remove use of uninitialised variables
  • simplify expression
  • join, plus, format, replace operator
  • split, reverse, invoke-expression
  • type convertion to type, string, char, array
  • replace constant variable with their value
  • fix special words case
  • ...

Example: BinaryExpressionAst node for format operator

Input
<BinaryExpressionAstOperator="Format"StaticType="System.Object">  <StringConstantExpressionAstStringConstantType="DoubleQuoted"StaticType="string">{0}{1}</StringConstantExpressionAst>  <ArrayLiteralAstStaticType="System.Object[]">    <Elements>      <StringConstantExpressionAstStringConstantType="SingleQuoted"StaticType="string">c</StringConstantExpressionAst>      <StringConstantExpressionAstStringConstantType="SingleQuoted"StaticType="string">AcA</StringConstantExpressionAst>    </Elements>  </ArrayLiteralAst></BinaryExpressionAst>
Output
<StringConstantExpressionAstStringConstantType="SingleQuoted"StaticType="string">cAcA</StringConstantExpressionAst>

Example

CTF challenge

Input
$mRSp73=  [ChaR[] ]" ))43]raHc[]gNIRtS[,)38]raHc[+98]raHc[+611]raHc[((eCAlper.)421]raHc[]gNIRtS[,'5IP'(eCAlper.)'$',)09]raHc[+99]raHc[+701]raHc[((eCAlper.)93]raHc[]gNIRtS[,'vzW'(eCAlper.)'2halB.tcejboZck tuptuO-etirW7halB.tcejboZck +'+' 6halB.tcejboZck + halB.tc'+'ejboZck '+'= 2galFFT'+'C:'+'vneZckSYt!eciNSYt = 1galFFTC:vneZckSYt...aedi dab yre'+'v'+' ,yre'+'v a yllacipyt svzWtaht ,ton fI .ti gninnur erofeb siht detacsufbo-ed uoy epoh ISYt eulaV- 2halB emaN- '+'ytreporPetoN epy'+'TrebmeM- rebmeM-ddA 5IP tcejboZckSYt'+'.uoy tresed dna dnuora nur annog reveNSYt eulaV- 9hal'+'B emaN- ytreporPetoN epyTrebmeM- rebmeM-ddA 5'+'IP tcejboZckSYt.nwod uo'+'y tel annog '+'re'+'veN .'+'pu uoy evig annog reveNSYt eulaV- 8halB emaN- ytreporPetoN epyTrebm'+'eM- rebmeM-d'+'dA 5IP tcejboZckSYt}f1j9kdSYt eulaV- 7halB emaN- y'+'treporPetoN ep'+'yTrebmeM- rebmeM-ddA 5IP tcejboZckSYtg4lf_3ht_t0nSYt eulaV- 4halB emaN- yt'+'reporPetoN epyTrebmeM- rebmeM-ddA 5IP tcejboZckSYt1#f!J{SYt eulaV- 6halB emaN- ytreporPetoN epyTrebmeM- rebmeM-'+'ddA 5IP tcejboZckSYtgalF,ehT,toN,oslASYt eulaV- 5halB emaN- ytreporPetoN epyTrebmeM- rebmeM-ddA 5IP tcejboZckSY'+'t}fdjfkslfdSYt eulaV- 3halB emaN- ytrepor'+'PetoN e'+'pyTrebmeM- rebmeM-ddA 5IP tcejboZ'+'ckSYtgalfSYt eulaV- halB em'+'aN- ytreporPetoN e'+'pyTrebmeM- rebmeM-ddA 5IP tcej'+'boZcktc'+'ejbO'+'SP tcejbO-weN = tc'+'ejboZck'( ()''nioJ-'x'+]3,1[)eCNERefErpESoBreV$]GniRTS[( (." ;[aRRAy]::REVerse($MrSp73);. ('IeX') (-JoiN$MrSp73)
Output
$object=New-Object PSObject;$object|Add-Member  NoteProperty  Blah"flag";$object|Add-Member  NoteProperty  Blah3"dflskfjdf}";$object|Add-Member  NoteProperty  Blah5"Also,Not,The,Flag";$object|Add-Member  NoteProperty  Blah6"{J!f`#1";$object|Add-Member  NoteProperty  Blah4"n0t_th3_fl4g";$object|Add-Member  NoteProperty  Blah7"dk9j1f}";$object|Add-Member  NoteProperty  Blah8"Never gonna give you up. Never gonna let you down.";$object|Add-Member  NoteProperty  Blah9"Never gonna run around and desert you.";$object|Add-Member  NoteProperty  Blah2"I hope you de-obfuscated this before running it. If not, that''s typically a very, very bad idea...";$env:CTFFlag1="Nice!";$env:CTFFlag2=$object.Blah+$object.Blah6+$object.Blah7;Write-Output$object.Blah2;

References

Releases

No releases published

Contributors2

  •  
  •  
[8]ページ先頭
©2009-2025 Movatter.jp