Deofuscation vbs (cscript.exe) - HackTricks

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Some things that could be useful to debug/deobfuscate a malicious VBS file:

## echo

    Wscript.Echo "Like this?"

## Commnets

    ' this is a comment

## Test

    cscript.exe file.vbs

## Write data to a file

    Function writeBinary(strBinary, strPath)

        Dim oFSO: Set oFSO = CreateObject("Scripting.FileSystemObject")

        ' below lines purpose: checks that write access is possible!
        Dim oTxtStream

        On Error Resume Next
        Set oTxtStream = oFSO.createTextFile(strPath)

        If Err.number <> 0 Then MsgBox(Err.message) : Exit Function
        On Error GoTo 0

        Set oTxtStream = Nothing
        ' end check of write access

        With oFSO.createTextFile(strPath)
            .Write(strBinary)
            .Close
        End With

    End Function

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.