rapid7/metasploit-framework — pull request #3840 by wchen-r7 (2014-09-20 23:59:25+00:00)
Title: Update BrowserExploitServer for JSObfu

This updates the BrwoserExploitServer mixin to work with the updated version of JSObfu.

Verification steps:

- [ ] Make sure travis pass
- [ ] Run windows/browser/ie_cbutton_uaf on a vulnerable xp to make sure the information gathering stage of BES is working.

Note that there is a new method #js_obfuscate. I added this method because typically in browser exploits we obfuscate like this:

```ruby
if datastore['OBFUSCATE']
js = ::Rex::Exploitation::JSObfu.new(js)
js.obfuscate
end
```

I don't really like this because:

1. You always have to check OBFUSCATE before you use it. It's a hassle.
2. Modules should never call Rex directly.

So instead, let's do this:

1 - The BES mixin registers a JsObfuscate datastore option. You set it to tell it how many times to obfuscate. The default is nil, which means no obfuscation.
2 - In your module, when you're adding JavaScript, you should always call #js_obfuscate like this:

```ruby
# This returns a Rex::Exploitation::JSObfu object
js = js_obfusate(js, datastore['JsObfucate'])
```
3 - If your module does not want js_obfuscate at all, you don't have to use it. But you should deregister the JsObfuscate option. As a code reviewer, try to enforce this.

After this PR is merged, I will update the wiki for BrowserExploitServer and JSObfu.

I invite @jvennix-r7 and @jvazquez-r7 to review this PR.