rapid7/metasploit-framework — pull request #3224 by jvennix-r7 (2014-04-09 22:05:45+00:00)
Title: Fixes large-string expansion in JSObfu

While working on the android js exploit, I noticed that attempting to run the js through JSObfu would cause even Chrome to hang and then error out. This is because we were calling `String.fromCharCode` with 30000+ arguments (since the exe is shoved into a js string). I've since fixed the string randomization to use chunks for large strings. I've also extracted the random var logic into a class, `JSObfu::Scope`, to ease testing and to possibly reuse in other places. The other piece of logic I've changed is how the `safe_split` method decides to randomly split the string. It would split (randomly) around every 4 chars before, now it uses larger chunks. Finally, I updated the var name generation to try to use the smallest possible var names.

Verification:

- [ ] Specs pass
- [ ] Add `alert(JSON.stringify(window.os_detect.getVersion()));` to the bottom of `data/js/detect/os.js`
- [ ] Run browser_auto_pwn multiple times against Chrome and another browser that is not an exploit target
- [ ] You should get a popup with the right version info.
- [ ] Test a browser exploit that uses the BrowserExploitServer mixin (`firefox_proto_crmfrequest` will work against FF 5-15)