.VBS SCRIPT DEBUGGER HOW TO
.VBS SCRIPT DEBUGGER WINDOWS

When deobfuscating VB Script programs with wscript, almost same rules apply as when using Spider Monkey with JavaScript.

.VBS SCRIPT DEBUGGER WINDOWS

Wscript is an interpreter that comes with Windows and that can easily execute VB Script programs. The screenshot below shows the important part where the decoded content is executed with the execute(decode(cde)) call (the program first calls the decode() function and then executes its output): The example malicious VB Script is almost the same as the one Maarten analyzed (and which one is pretty popular. I will explain methods 1) and 3) here and leave 2) for a future diary (or as an exercise to you, if you find this whole diary interesting).

Use Microsoft Script Editor from Internet Explorer.

Use Microsoft Script Debugger from Internet Explorer.

Use Windows Script Host which can execute VBScript from the command line (the wscript command).

As an analyst, you now have the following options

The main problem with VBScript is that you basically have to run it on Windows – there aren’t any stand alone VBScript interpreters for Linux (as far as I know – if you know of one please let us know through our contact form).Īs we have to work with malicious VBScript programs on Windows platforms this means also that we have to be extra careful – we are actually using the platform that the original exploit was written for (virtual machines come to help here – you don’t want to infect your main host accidentally).

.VBS SCRIPT DEBUGGER HOW TO

I’ve been thinking about writing a diary about how to deobfuscate VBScript for quite some time and recently even received couple of e-mails about this (since we covered JavaScript deobfuscation pretty thoroughly here I would say), so here we go. Couple of days ago Maarten wrote a nice diary about an iframe tage pointing to a “benign” VBScript that was planted on a relatively high profile web site in Belgium (the original diary is here: ).

.vbs script debugger