Package: self-unzip-html
self-unzip.htmlThisrepocontains tools to create self-extracting HTML pages.
It works by taking a payload, compressing it, and encoding the results using ASCII85.
It then puts the resulting string in a template file, that contains the code to decode and decompress the payload again.Currently there are three actions implemented, that can be executed, after the payload is decoded:eval: Execute payload as JavaScript code (example usecase: obfuscate malicious JS code)replace: Show payload as HTML page (example usecase: compress a big web page)download: Download the payload as a file (example usecase: bypass antivirus / filters)DemoYou can try the online demo atself-extracting-html.six-two.dev.
This version is the same as the web version described below.
It is entirely client-site, your files do not get uploaded to a server.InstallationCurrent feature comparisionCurrently the python version has the most features.FeatureWeb versionPython versionBase64 encodingnoyesAscii85 encodingyesyesGZIP compressionyes, alwaysyes, can be disabledAES-GCM encryptionnoyesAutomatic detection of most efficient algorithmsnoyesWeb versionThere is a bare-bones page generator written in plain HTML and JavaScript.
To use it, just clone the repo and put the contents of thesitedirectory somewhere in your web server directory.You can of course also use it with Python's built in web server:python3-mhttp.server--directory./site/Python versionA Python script to generate self extracting web pages is underpython/main.py.
It just requires a modern Python version (probably Python3.9+) and has no required external dependencies (but you need to installpycryptodomexif you want to encrypt contents).You can also install it withpip:python3-mpipinstall-Uself-unzip-htmlExample usage of the pip package:self-unzip-html-tdownload-opsexec.html~/Downloads/SysinternalsSuite/PsExec.exeOr if you wanted to password-protect it:self-unzip-html-tdownload-opsexec.html-pYourPasswordHere~/Downloads/SysinternalsSuite/PsExec.exeEncryptionEncryption uses AES-GCM for encryption and tamper detection and PBKDF2 with slightly over 1 million rounds of SHA-256 for password derivation.
The code has not been audited, so use it with caution.
If data security is very important to you may want to manually encrypt it beforehand (for example usinggpg).You can automatically decrypt a page by adding the password as the hash in a URL likeencrypted.html#monkey123!.
The hash will not be sent to the server, so your password may only be stored locally (in your browsing history).
Otherwise a prompt will ask you for the password.JavaScript codePythonThe JavaScript code is modular to decrease size and allow mixing and matching different algorithms.
The unminified files are incode_to_minify/.
They are minified by runningcode_to_minify/build.sh, which updatespython/self_unzip_html/minified_js.py.template.htmlThis basically just explains, how I generated the obfuscated script intemplate.html(JavaScript version).
In case you are paranoid, you can reproduce the steps.
Or if there is an important update tofflateorascii85, I will have to run them again.Install with npm:npminstall.First use rollup to only select the actually used code:./node_modules/.bin/rollup-crollup.config.jsThis command should createoutput/main.jsThe next step is optional.
If you want to skip it, just renamemain.min.jstomain.jsin theoutputdirectory.
Otherwise minify the code (may require you to install an external minifier like closure-compiler).closure-compileroutput/main.js--js_output_fileoutput/main.min.js