Skip to content

Instantly share code, notes, and snippets.

@chrdek
Created May 17, 2020 14:54
Show Gist options
  • Select an option

  • Save chrdek/fa65a1ff4a48853aac1168d24e07d1f7 to your computer and use it in GitHub Desktop.

Select an option

Save chrdek/fa65a1ff4a48853aac1168d24e07d1f7 to your computer and use it in GitHub Desktop.
Automated dll file obfuscation via confuser.
$execobf = [ScriptBlock]{
[string[]]$config = @("$(Resolve-Path .)","A.Module.Name.dll");
[int]$obflvl = $(Read-Host "Enter an obfuscation option [0-4]"); #0 - Level0 obf. debuggable, 1 - Level1 obf. debuggable-noil, 2 - Level2 obf. not debuggable, 3 - Level3 obf. not mergable, 4 - Level4 obf. not usable
$ops = @'
PHByb2plY3Qgb3V0cHV0RGlyPSJ7T1VURElSfSIgYmFzZURpcj0ie0JBU0VESVJ9IiBkZWJ1Zz0idHJ1ZSIgeG1sbnM9Imh0dHA6Ly9jb25mdXNlci5jb2RlcGxleC5jb20iPg0KICA8bW9kdWxlIHBhdGg9IntNT0RVTEV9Ij4NCiAgPHJ1bGUgcGF0dGVybj0idHJ1ZSIgaW5oZXJpdD0iZmFsc2UiIC8+DQogIDwvbW9kdWxl
Pg0KPC9wcm9qZWN0Pg==;
PHByb2plY3Qgb3V0cHV0RGlyPSJ7T1VURElSfSIgYmFzZURpcj0ie0JBU0VESVJ9IiBkZWJ1Zz0idHJ1ZSIgeG1sbnM9Imh0dHA6Ly9jb25mdXNlci5jb2RlcGxleC5jb20iPg0KICA8bW9kdWxlIHBhdGg9IntNT0RVTEV9Ij4NCiAgICA8cnVsZSBwYXR0ZXJuPSJ0cnVlIiBpbmhlcml0PSJmYWxzZSI+DQogICAgICA8cHJv
dGVjdGlvbiBpZD0iYW50aSBpbGRhc20iLz4NCiAgICA8L3J1bGU+DQogIDwvbW9kdWxlPg0KPC9wcm9qZWN0Pg==;
PHByb2plY3Qgb3V0cHV0RGlyPSJ7T1VURElSfSIgYmFzZURpcj0ie0JBU0VESVJ9IiB4bWxucz0iaHR0cDovL2NvbmZ1c2VyLmNvZGVwbGV4LmNvbSI+DQogIDxtb2R1bGUgcGF0aD0ie01PRFVMRX0iPg0KICAgIDxydWxlIHBhdHRlcm49InRydWUiIHByZXNldD0iYWdncmVzc2l2ZSIgaW5oZXJpdD0iZmFsc2UiPg0KICAg
ICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgaWxkYXNtIiAvPg0KICAgICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgZHVtcCIgLz4NCiAgICAgIDxwcm90ZWN0aW9uIGlkPSJjb25zdGFudHMiIC8+DQogICAgPC9ydWxlPg0KICA8L21vZHVsZT4NCjwvcHJvamVjdD4=;
PHByb2plY3Qgb3V0cHV0RGlyPSJ7T1VURElSfSIgYmFzZURpcj0ie0JBU0VESVJ9IiB4bWxucz0iaHR0cDovL2NvbmZ1c2VyLmNvZGVwbGV4LmNvbSI+DQogIDxtb2R1bGUgcGF0aD0ie01PRFVMRX0iPg0KICAgIDxydWxlIHBhdHRlcm49InRydWUiIHByZXNldD0iYWdncmVzc2l2ZSIgaW5oZXJpdD0iZmFsc2UiPg0KICAg
ICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgdGFtcGVyIiAvPg0KICAgIDwvcnVsZT4NCiAgPC9tb2R1bGU+DQo8L3Byb2plY3Q+;
PHByb2plY3Qgb3V0cHV0RGlyPSJ7T1VURElSfSIgYmFzZURpcj0ie0JBU0VESVJ9IiB4bWxucz0iaHR0cDovL2NvbmZ1c2VyLmNvZGVwbGV4LmNvbSI+DQogIDxtb2R1bGUgcGF0aD0ie01PRFVMRX0iPg0KICAgIDxydWxlIHBhdHRlcm49InRydWUiIHByZXNldD0iYWdncmVzc2l2ZSIgaW5oZXJpdD0iZmFsc2UiPg0KICAg
ICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgaWxkYXNtIi8+DQogICAgICA8cHJvdGVjdGlvbiBpZD0iaW52YWxpZCBtZXRhZGF0YSIvPg0KICAgICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgZHVtcCIvPg0KICAgICAgPHByb3RlY3Rpb24gaWQ9ImFudGkgdGFtcGVyIi8+DQogICAgICA8cHJvdGVjdGlvbiBpZD0iY29uc3RhbnRz
Ii8+DQogICAgICA8cHJvdGVjdGlvbiBpZD0icmVmIHByb3h5Ii8+DQogICAgICA8cHJvdGVjdGlvbiBpZD0icmVzb3VyY2VzIi8+DQogICAgICA8cHJvdGVjdGlvbiBpZD0icmVuYW1lIi8+DQogICAgPC9ydWxlPg0KICA8L21vZHVsZT4NCjwvcHJvamVjdD4=
'@ -isplit";" -ireplace "`r`n","";
if ($obflvl -in @(0,1,2,3,4)) {
if(Test-Path -Path ".\$($obflvl).crproj") {
rm ".\$($obflvl).crproj"; rm ".\temp.txt";
}
[System.Convert]::FromBase64String("$($ops[$obflvl])") | Set-Content -Path ".\temp.txt" -Encoding Byte;
$output = Get-Content -Path ".\temp.txt" | %{ $_ -replace "`"{OUTDIR}`"", "`"$($config[0])\Confused`"" -replace "`"{BASEDIR}`"","`"$($config[0])`"" -replace "`"{MODULE}`"","`"$($config[1])`"" }; Set-Content -Value $output -Path ".\$($obflvl).crproj";
}
$isOnline = @($((Test-NetConnection www.google.com -Port 443 -InformationLevel Detailed -WarningAction SilentlyContinue).TcpTestSucceeded));
if ( (-not $isOnline[0]) ) {
try {
if (Test-Path ".\ConfuserEx_bin\Confuser.CLI.exe") {
Start-Process -FilePath $(Resolve-Path ".\ConfuserEx_bin\Confuser.CLI.exe").Path -ArgumentList @("$($config[0])\$($obflvl).crproj") -RedirectStandardError ".\error-obf.txt" -ErrorAction Stop;
}
}
catch {
$error = [Exception]::new("Exe problem"); Write-Error -Exception $error -Message "Exe cannot be found, try installing it.";
}
} else { # try and get confuser_ex from online source.
wget -Uri "https://github.com/yck1509/ConfuserEx/releases/download/v1.0.0/ConfuserEx_bin.zip" -Method Get -UseDefaultCredentials -OutFile "ConfuserEx_bin.zip";
$path = $(Resolve-Path ".\ConfuserEx_bin.zip").Path; Expand-Archive -Path "$path" -DestinationPath ([Regex]::Replace($(Split-Path "$path" -Leaf),"\.zip","")) -Force
Start-Process -FilePath $(Resolve-Path ".\ConfuserEx_bin\Confuser.CLI.exe").Path -ArgumentList @("$($config[0])\$($obflvl).crproj") -RedirectStandardError ".\error-obf.txt" -ErrorAction Stop;
}
}; Invoke-Command -ScriptBlock $execobf;
# Execute remotely as a background job.
# Invoke-Command -ScriptBlock $execobf -Session $(New-PSSession -ComputerName YourServerhere) -JobName "BGOBF-001" -AsJob;
# Get-Job -Name "BGOBF-001" | Wait-Job -Name "BGOBF-001" -Timeout 5;
# Get-Job -Name "BGOBF-001" | Start-Job -Name "BGOBF-001";
# Get-Job -Name "BGOBF-001" | Remove-Job -Name "BGOBF-001";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment