# Linux BASH Obfuscation
- [Bashfuscator](https://github.com/Bashfuscator/Bashfuscator) can be used to obfuscate BASH commands
- Installing `bashfuscator`
```bash
git clone https://github.com/Bashfuscator/Bashfuscator
cd Bashfuscator
pip3 install setuptools==65
python3 setup.py install --user
```
- Using `bashfuscator`
```bash
cd ./bashfuscator/bin/
./bashfuscator -h #shows help menu
./bashfuscator -c 'cat /etc/passwd' #use the -c flag too specify a command to obfuscate
[+] Mutators used: Token/ForCode -> Command/Reverse
[+] Payload:
${*/+27\[X\(} ...SNIP... ${*~}
[+] Payload size: 1664 characters
```
- Running the tool this way will randomly pick an obfuscation technique, which can output a command length ranging from a few hundred characters to over a million characters
- So, we can use some of the flags from the help menu to produce a shorter and simpler obfuscated command
```bash
./bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1
[+] Mutators used: Token/ForCode
[+] Payload:
eval "$(W0=(w \ t e c p s a \/ d);for Ll in 4 7 2 1 8 3 2 4 8 5 7 6 6 0 9;{ printf %s "${W0[$Ll]}";};)"
[+] Payload size: 104 characters
```
- Test command by using `bash -c '<obfuscated_command>'`
# Windows Obfuscation
- [DOSfuscation](https://github.com/danielbohannon/Invoke-DOSfuscation) is similar to the above Linux tool; however, it employs an interactive approach to obfuscation
- Installing `DOSfuscation`
```powershell
PS C:\htb> git clone https://github.com/danielbohannon/Invoke-DOSfuscation.git
PS C:\htb> cd Invoke-DOSfuscation
PS C:\htb> Import-Module .\Invoke-DOSfuscation.psd1
PS C:\htb> Invoke-DOSfuscation
Invoke-DOSfuscation> help
HELP MENU :: Available options shown below:
[*] Tutorial of how to use this tool TUTORIAL
...SNIP...
Choose one of the below options:
[*] BINARY Obfuscated binary syntax for cmd.exe & powershell.exe
[*] ENCODING Environment variable encoding
[*] PAYLOAD Obfuscated payload via DOSfuscation
```
- Try running obfuscated command with `cmd.exe`
```cmd
C:\htb> typ%TEMP:~-3,-2% %CommonProgramFiles:~17,-11%:\Users\h%TMP:~-13,-12%b-stu%SystemRoot:~-4,-3%ent%TMP:~-19,-18%%ALLUSERSPROFILE:~-4,-3%esktop\flag.%TMP:~-13,-12%xt
test_flag
```
- Note: If we do not have access to a Windows VM, we can run the above code on a Linux VM through `pwsh`
- Run `pwsh`, and then follow the exact same command from above